topic Numeric Formatting in Splunk Search

Numeric Formatting

mirianseffrin — Mon, 28 Sep 2020 17:46:23 GMT

Hi, In search time I make a field "eval values = substr (_raw, 82.15)" divided by 100 "eval value = round ((value / 100), 2" the splunk considers it a number and leave with two decimal places in 00.00 format and then I add to display "sum (amount) AS TOTAL_VALOR".
When the result is too large so it appears 211712.76, so I used the command comas "| fieldformat TOTAL_VALOR =" $ "tostring (TOTAL_VALOR," commas ")" so it would appear so $ 211,712.76.
But what I want is for it to appear in the Brazilian standard R $ 211.712,76.
I do not know where I'm going wrong, I am user queries, do not quite understand the setup, I have to change or install something so that he understands the standard Portuguese / Brazil?

Re: Numeric Formatting

lguinn2 — Thu, 02 Oct 2014 00:18:41 GMT

Sadly tostring does not understand locale.

But you could do this

| fieldformat TOTAL_VALOR = tostring (TOTAL_VALOR," commas ")
| eval TOTAL_VALOR = replace(TOTAL_VALOR,"\,",";")
| eval TOTAL_VALOR = replace(TOTAL_VALOR,"\.",",")
| eval TOTAL_VALOR = replace(TOTAL_VALOR,"\;",".")

It's a pain, I know, but you could put it in a macro and reuse it...