topic Re: PDF Export and Eval in Splunk Search

PDF Export and Eval

devicenul1 — Thu, 12 Jun 2014 13:41:17 GMT

6.1.1 known issues:
Events format settings like list, table, max lines, wrapping do not apply to PDF reports and are not used. (SPL-67491)

Were using Eval to do comma formatting on some fields:
eval Merch=tostring(Merch,"commas")

and noticed that in the generated pdf fields formatted with commas are not in line like they are with the dashboard. The other numbers are right aligned, they are left aligned

(dashboard)
|Merch |
| 1,260.00|

(exported pdf)
|Merch |
|1,260.00 |

Re: PDF Export and Eval

devicenul1 — Fri, 13 Jun 2014 13:01:15 GMT

no one else having this problem?

Re: PDF Export and Eval

somesoni2 — Fri, 13 Jun 2014 14:31:23 GMT

After making is comma formatted, the PDF generator code treat that as 'Text' instead on 'Number'. All text are Left aligned, hence the issue.

Re: PDF Export and Eval

devicenul1 — Fri, 13 Jun 2014 18:29:25 GMT

That makes complete sense ... if you come back and make an answer I'll mark it for you ^^. I worked around this by converting our columns in SQL, something like:

CONVERT(varchar(12), CONVERT(MONEY, table.column), 1) as MoneyColumn

Re: PDF Export and Eval

devicenul1 — Tue, 17 Jun 2014 19:35:36 GMT

The above convert actually ended up being bad news bears for me. We had total columns and it was causing values with formatting to be excluded from the total. I had to go back to no CONVERT in the SQL but doing the |addtotals first then | eval Column=tostring(Column,"commas")

Re: PDF Export and Eval

somesoni2 — Tue, 17 Jun 2014 19:55:51 GMT

I have the same issue and I ended up adding a pipe character and 6 spaces before each value (after all the totalling). Not a good solution but it looks acceptable in the PDF/printed form.

all search with total | eval mytotal="| ".tostring(mytotal,"commas")

Re: PDF Export and Eval

devicenul1 — Wed, 18 Jun 2014 15:17:25 GMT

The space idea was a good work around, it still doesn't line up for me but it is a good thought. I know it's not excel but it kind of stinks you can't just pick a justification on a table (left or right) and it's applied to all data in the table.

Re: PDF Export and Eval

splunkn — Fri, 10 Oct 2014 08:42:29 GMT

Hi. I have a similar issue like this. I want to extract the users list which contains ids (numbers) and names(text). As you discussed text are left aligned and numbers are right aligned. But i append space with that field. Still those are not changing. Could you please help?

search ... | eval Users = " " + username | table Users | sort Users