Keep numbers right-aligned after using fieldformat

[mjosen]

Hello,

I have a numeric field that I convert to a comma separated number using fieldformat. The only problem is that after the conversion it changes the format from right align to left align. Since this is a numeric field, is there anyway to keep the column right-aligned with commas? It's very difficult to compare numbers within a column when they are all left-aligned. Thanks.

[lguinn2]

In Splunk 6.5, you can format a table column in a dashboard. You can apply both numeric and color formatting. This is preferable to using the fieldformat command.

fieldformat never worked consistently (when combined with other commands) to display a formatted numeric value while preserving the underlying field as numeric.

Here is the documentation showing how to Format table visualizations.

[jrodman]

This is tricky, because the fields don't have any alignment, they're just strings in a conceptual table. However, the UI tries to make some guesses on how to display them based on their content.

Thus there's little in the search language that can control the UI behavior (unless we implement some kind of ui-hint-field which doesn't currently exist). Some more direct control in the UI would be nice, but that wouldn't persist cleanly in a search for all users. I think this boils down to an Enhancement Request.

[cchange]

Do we have any solution in v6.5 for this issue?

[Flynt]

How are you using fieldformat? Using the example below, it appears to right format in 6.5.0 when using tostring "commas".

|stats count|fields - count |eval number=10000  |fieldformat formattednumber=tostring(number,"commas")  

[season88481]

Same problem here. We are using v6.4. And column became left-aligned after applying a fieldformat command.

[niketn]

@cchange and @season88481...Can you give example of query / mock data? It works fine for me in 6.4.3 as well as 6.5. Following is the run anywhere search I tested:

| makeresults
| eval TestNumber=12345678912345
| fieldformat TestNumber=tostring(TestNumber,"commas")
| table _time TestNumber

[rettops]

Did you ever find a solution to this? I'm looking for the same thing - some way to force the chart's text alignment to right align.