In a dashboard panel search, can Splunk automatically append the appropriate ordinal indicator to a number?

[russelljesse]

I have a search in a dashboard panel that ends up representing a results "place in line" with a single number, its comparison to all other results. The most common way to indicate this, for example, is by "1st" "2nd" or "44th" so on and so forth.

Is there any way to get Splunk to automatically append the appropriate ordinal indicator to a number?

The only way I could think is to use a very complex eval and if combination to pipe the search results in to a text concatenation like

eval Place=Place."st"

But this would get lengthy as there are several rules to follow:

Values ending in 0 always get th
Values ending in 1 get st unless the value is 11 or a value that ends with 11
Values ending in 2 get nd unless the value is 12 or a value that ends with 12
Values ending in 3 get rd unless the value is 13 or a value that ends with 13
Everything else gets th

Can Splunk accomplish this automatically?

[diogofgm · Accepted solution]

I don't think splunk can do it automatically. Nevertheless, the eval is not that complex:

| makeresults 
| eval foo = 12
| fields - _time
| eval ordinal = foo + case((tonumber(substr(foo,-2),10) >= 10 AND tonumber(substr(foo,-2),10) <= 20),"th",foo%10 = 1,"st",foo%10 = 2,"nd",foo%10 = 3,"rd",true(),"th")

[russelljesse]

Thanks diogofgm, you're right it did not end up being as complex as I thought it would, but I think you're missing some of the conditions, especially "everything else gets th"

I changed it to:
eval ordinal = foo + case((foo>=10 AND foo<=20),"th",foo%10 = 1,"st",foo%10 = 2,"nd",foo%10 = 3,"rd",true(),"th")

The true() will match everything else as yet undefined by the case and give it "th"

However this still doesn't handle foo values ending 11,12,or 13 like 1,112, which will get "1112nd" with the above code.

[diogofgm]

I noticed those points when I posted and updated my answer after posting. You probably saw the 1st version.

[russelljesse]

Yep I did, and your new version covers the "everything else" condition AND the ending in 11,12,13. Nice work and thank you for the help.

[diogofgm]

please accept it as an answer, so appears to others as answered