Dashboards & Visualizations

Dashboard Studio Format Values on Chart

chrisboy68
Contributor

Hi, 

I have simple chart visulization, with base SPL

.... | chart sum(cost) AS total_cost BY bill_date

 I'm trying to add a "$" format to total_cost to show on the columns. Tried every Google and ChatGPT trick and I can't get it working. Any ideas? Thanks!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do the Google and ChatGPT tricks include this?

... | chart sum(cost) AS total_cost BY bill_date
| eval total_cost = "$" . total_cost

I'm not entirely sure it will work, but worth a try.

---
If this reply helps you, Karma would be appreciated.
0 Karma

livehybrid
SplunkTrust
SplunkTrust

I was trying to make this work too but unfortunately @chrisboy68 I'm also a bit of a dead end. 

Prefixing by eval-ing the field for me breaks the chart as its no longer a numeric value, there is no option to add a prefix/suffix in the visualisation; I scoured the non-UI based options from the viz docs (e.g. https://splunkui.splunk.com/Packages/visualizations/Column) but also couldnt find any way to do this, sorry!

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

chrisboy68
Contributor

Thanks. That was my first try, but still didn't work. 

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...