topic How to format fields globally based on the data type used? in Splunk Search

How to format fields globally based on the data type used?

ronak — Mon, 28 Sep 2020 19:21:04 GMT

Hello

Is there any way by which I can set the formatting at once central place and it takes effect wherever that data type is used. For example, I define types like US_CURRENCY, NUMBER_WITH_COMMAS, etc...and then in query I can simply mark the field to be US_CURRENCY so that it is represented as $389.90 instead of 380.90

Any pointers would be appreciated

thanks, ronak

Re: How to format fields globally based on the data type used?

martin_mueller — Thu, 26 Mar 2015 23:23:08 GMT

You could create a macro US_CURRENCY(1) that takes the field as its argument and is defined something like this:

fieldformat $field$ = "$$".'$field$'

and use it in your searches like this:

some search | `US_CURRENCY(total)` | ...