topic Re: How do I format the output in Splunk Search

How do I format the output

JohnB — Thu, 26 Aug 2010 19:55:40 GMT

on a chart or timechart? I want to have the output be in currency format. I can use the eval and tostring() for a cludge, but is there a better way?

Re: How do I format the output

Stephen_Sorkin — Thu, 26 Aug 2010 23:11:24 GMT

Using eval is the best way to solve this problem.

Re: How do I format the output

gkanapathy — Fri, 27 Aug 2010 11:42:32 GMT

There is unfortunately not a better way currently. It would be nice to have the charts and tables able to render numbers without changing the underlying data as eval() does (for example, sorting columns of numbers and timestamps doesn't work right when they've been converted to strings for display formatting, and automatic drilldown won't work with such post-reporting conversions on charts).

Re: How do I format the output

JohnB — Fri, 27 Aug 2010 19:25:56 GMT

I used eval X="$" . tostring(X,"commas")
to format, however, there is a bug in tostring(X,"commas") it's supposed to be in comma & 2 decimal places format, but alas, it's not. It's a wonder why I keep telling Godfrey QA needs to be better?

Re: How do I format the output

Stephen_Sorkin — Fri, 27 Aug 2010 20:48:16 GMT

What is the exact string that tostring(X, "commas") is failing on? I've tried this (limited) example successfully: | stats count | eval count =123456789.12345 | eval count = "$" . tostring(count, "commas"). I'll file a bug on your behalf if you help me reproduce.

Re: How do I format the output

wagnerbianchi — Mon, 28 Sep 2020 12:46:43 GMT

Just adding my 2 cents with a practical example, here I go:

This query will retrieve information about the purchased products based on Apache access logs.

Cheers!

Re: How do I format the output

msmapper — Wed, 26 Mar 2014 21:50:57 GMT

The best option would be to use | fieldformat amount= "$" + tostring(amount, "commas"). Using fieldformat vs. eval keeps the data numeric, whereas email considers the data to be a string.

Re: How do I format the output

nawneel — Tue, 28 Apr 2015 05:49:28 GMT

correction to above its not email but eval , i guess that is a typo

Re: How do I format the output

si_rbrisita — Thu, 21 Jan 2016 20:58:04 GMT

For anyone looking to format using integers:

stat_name=sales | timechart sum(total_price) AS total | eval cents = substr(total, -2) | eval dollars = substr(total, 1, len(total) - 2) | eval Revenue = "$" + tostring(dollars, "commas") + "." + cents