topic Re: how to place commas in the output of a chart with columns that varies depending on the search in Splunk Search

how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Mon, 04 Jul 2016 14:54:13 GMT

how to place commas in the output of a chart with columns that varies depending on the search (example is date). Sample search would be index=indexname | chart count(fieldname) over xfieldname by date_mday. Results are numerals which i intend to place commas as a thousands separator but was unable to do so because i do not know how would i command a tostring to a variable column name. please help.

Re: how to place commas in the output of a chart with columns that varies depending on the search

sundareshr — Mon, 04 Jul 2016 15:11:12 GMT

Try this

... | foreach * [eval <<FIELD>>=if("<<FIELD>>" == "date_mday", <<FIELD>>, tostring(round('<<FIELD>>', 2), "commas")))]

Re: how to place commas in the output of a chart with columns that varies depending on the search

woodcock — Mon, 04 Jul 2016 15:39:41 GMT

First of all, DO NOT use the "free" (but always wrong) date_* fields, calculate your own like this

... | eval date_mday = strftime(_time, "%d")

As far as commas, do this:

...| foreach * [ eval <<FIELD>>= if(isnum($<<FIELD>>$), tostring($<<FIELD>>$, "commas"), $<<FIELD>>$) ]

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Tue, 05 Jul 2016 11:08:53 GMT

did not seem to get the solution applying the above formula. here is my search:

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") | chart eval(round(count(PRODUCT)2.5,2)) over TYPE by YMD useother=f limit=500 | addtotals col=true 2016- labelfield=TYPE label="Product Type Totals" fieldname="Totals"

i need to place commas on all numeric values inside columns and totals

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Tue, 05 Jul 2016 11:09:00 GMT

did not seem to get the solution applying the above formula. here is my search:

i need to place commas on all numeric values inside columns and totals

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Tue, 05 Jul 2016 11:10:42 GMT

to add, the sum of "tostring" values when adding commas are not reflected on totals

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Tue, 05 Jul 2016 11:10:47 GMT

to add, the sum of "tostring" values when adding commas are not reflected on totals

Re: how to place commas in the output of a chart with columns that varies depending on the search

sundareshr — Tue, 05 Jul 2016 11:27:07 GMT

Try this

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") | chart sum(eval(round((PRODUCT*2.5),2))) over TYPE by YMD useother=f limit=500 | addtotals col=true 2016- labelfield=TYPE label="Product Type Totals" fieldname="Totals" |  foreach * [eval <<FIELD>>=if("<<FIELD>>" == "YMD", <<FIELD>>, tostring('<<FIELD>>', "commas")))]

Re: how to place commas in the output of a chart with columns that varies depending on the search

woodcock — Tue, 05 Jul 2016 14:16:29 GMT

I just tried it (again) and it worked perfectly. Try this:

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") 
| chart eval(round(count(PRODUCT)*2.5,2)) over TYPE by YMD useother=f limit=500
| addtotals col=true 2016-* labelfield=TYPE label="Product Type Totals" fieldname="Totals"
| foreach * [ eval <<FIELD>>= if(isnum($<<FIELD>>$), tostring($<<FIELD>>$, "commas"), $<<FIELD>>$) ]

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Thu, 07 Jul 2016 02:41:12 GMT

thanks woodcock it worked using manual search.
one problem though, on my dashboard, i have a timerange ticker. the search we have (with dollar sign) does not load on a time range ticker dashboard. maybe the value of the time range ticker is being replaced on our search with dollar signs?

the panel is showing "search is waiting for input..."

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Thu, 07 Jul 2016 02:47:46 GMT

hi sundareshr thanks for your effort. however using your search does not show the "TYPE" column on the output.

Re: how to place commas in the output of a chart with columns that varies depending on the search

woodcock — Thu, 07 Jul 2016 03:54:05 GMT

Escape the dollar-signs by adding a second one next to each.

Re: how to place commas in the output of a chart with columns that varies depending on the search

jonathan_yan5 — Thu, 07 Jul 2016 07:13:31 GMT

Wow! thanks a lot, it worked!