topic Format Result set Numbers in Splunk Search

Format Result set Numbers

lpolo — Mon, 28 Nov 2011 15:13:07 GMT

I have the following result set:

_time                       Visits
Sunday, November 27, 2011   667044
Saturday, November 26, 2011 659234
Sunday, November 20, 2011   648686
Saturday, October 29, 2011  640808

Is there a way to format the Visits' number as follow?

_time                       Visits
Sunday, November 27, 2011   667,044
Saturday, November 26, 2011 659,234
Sunday, November 20, 2011   648,686
Saturday, October 29, 2011  640,808

Regards,
Lp

Re: Format Result set Numbers

tgow — Mon, 28 Nov 2011 16:21:41 GMT

You can use the fieldformat command to accomplish this.

Try this in search:

| fieldformat Visits = tostring(Visits, "commas") | table _time, Visits

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.2.4/SearchReference/Fieldformat

Re: Format Result set Numbers

lpolo — Mon, 28 Nov 2011 16:28:20 GMT

It worked great.

Thanks.
Lp

Re: Format Result set Numbers

banchio — Thu, 18 Dec 2014 10:51:21 GMT

Hi everybody!
This solution is great, but if you change column values to string you'll lose the ability to automatically calculate column totals: such totals will be wrong since they'll ignore every value containing commas.
Is there a way to apply this formatting without invalidating "|addcoltotals" functionalities?

Thank you very much in advance,
Matteo

-- EDIT --
SOLUTION is to pospone | eval tostring(...,"commas") to |addcoltotals: then everything is working fine!