- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Adding commas to "stats sum"
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'm trying to add commas to the TotalPrints field as shown in the code below. I have tried the fieldformat=stringto but it just creates an empty additional TotalPrints field. Can someone please advise?
Also a quick one, how can I make the TotalPrints in descending order and limit it top top 10? I have tried sort- and limite=10 but it doesnt appear to do anything..
source="PrinterDemo.csv"
| multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints
| stats sum(TotalPrints) by "Location"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks very much 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Alternatively, you could use | fieldformat sum(TotalPrints) = tostring('sum(TotalPrints)', "commas") but I prefer somesoni2's approach!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yup... at the end I've added
| fieldformat TotalPrints=tostring(TotalPrints,"commas")
and
|fieldformat "sum(TotalPrints)"=tostring(TotalPrints,"commas")
no joy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you show what your search string when you tried to use fieldformat looked like?
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
