Splunk Search

How to add a comma separator to field numeric values using fieldformat command?

tmurray3
Path Finder

Have have a query that creates a timechart. I want to add a comma separator to the field numeric values. When I run the query it adds an extra field, plus the numeric values are not formatted.

Here is the query:

index=service_hourly_summary report="bystatus" earliest=-2w@w latest=@w|timechart span=1w sum(count) by status|rename _time as time |eval time=strftime(time,"%m/%d") | rename time as WeekOf|fieldformat status=tostring(status,"commas")| addtotals col=true row=false labelfield="Total Volume"| table WeekOf,*,"Total Volume"

       WeekOf FAILED SUCCESS  Total Volume   status
1      08/24   7577    66548
2      08/31   6882    58116
3              14459   24664  Total

Status has two values FAILED or SUCCESS, but I can't get the field formatted with commas. Also, is there a way to get rid of the Total Volume header, but keep the Total label in row 3?

Thanks in advance for your help!!

Tags (1)
1 Solution

kmattern
Builder

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals

View solution in original post

kmattern
Builder

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...