topic Re: Replace comma with the dot in Splunk Search

Replace comma with the dot

lrudolph — Wed, 16 Oct 2013 12:36:46 GMT

Hi,

I have evaluated a field count with value 10000. Then I converted it with fieldformat to include a thousand separator to display it on a single value panel. Now I want to replace the comma with a dot, because we are in Europe. How can I do that?

I already tried this:

searchstring | stats count |
fieldformat count=tostring(count,
"commas") | rex field=count mode=sed
"s/\,/./g"

The result makes no difference - it's still as if I didn't use the rex-command.

Thanks,

Leo

Re: Replace comma with the dot

lukejadamec — Wed, 16 Oct 2013 13:04:57 GMT

An older post suggests that the "commas" operator is locale specific, i.e. it should use decimals for Europe...
http://answers.splunk.com/answers/41636/tostring-commas-and-locale-specific-separators

Re: Replace comma with the dot

sowings — Wed, 16 Oct 2013 13:29:32 GMT

I agree that fieldformat doesn't seem to play nice. I wonder if its execution is "delayed" in that the formatting rules it dictates are only applied late (at display level). In any event, I was able to get the desired effect with this:

searchstring | stats count | eval count=tostring(count, "commas") | rex field=count mode=sed "s/,/./g"

The other answers post quoted by @lukejadamec says that commas should be locale-specific, but my own experimentation suggests that it is not. I've filed a case.

Re: Replace comma with the dot

lrudolph — Wed, 16 Oct 2013 15:44:23 GMT

Perfect! This does the trick!