Dashboards & Visualizations

In a dashboard panel search, can Splunk automatically append the appropriate ordinal indicator to a number?

russelljesse
Explorer

I have a search in a dashboard panel that ends up representing a results "place in line" with a single number, its comparison to all other results. The most common way to indicate this, for example, is by "1st" "2nd" or "44th" so on and so forth.

Is there any way to get Splunk to automatically append the appropriate ordinal indicator to a number?

The only way I could think is to use a very complex eval and if combination to pipe the search results in to a text concatenation like

eval Place=Place."st"

But this would get lengthy as there are several rules to follow:

Values ending in 0 always get th
Values ending in 1 get st unless the value is 11 or a value that ends with 11
Values ending in 2 get nd unless the value is 12 or a value that ends with 12
Values ending in 3 get rd unless the value is 13 or a value that ends with 13
Everything else gets th

Can Splunk accomplish this automatically?

0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

I don't think splunk can do it automatically. Nevertheless, the eval is not that complex:

| makeresults 
| eval foo = 12
| fields - _time
| eval ordinal = foo + case((tonumber(substr(foo,-2),10) >= 10 AND tonumber(substr(foo,-2),10) <= 20),"th",foo%10 = 1,"st",foo%10 = 2,"nd",foo%10 = 3,"rd",true(),"th")
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

I don't think splunk can do it automatically. Nevertheless, the eval is not that complex:

| makeresults 
| eval foo = 12
| fields - _time
| eval ordinal = foo + case((tonumber(substr(foo,-2),10) >= 10 AND tonumber(substr(foo,-2),10) <= 20),"th",foo%10 = 1,"st",foo%10 = 2,"nd",foo%10 = 3,"rd",true(),"th")
------------
Hope I was able to help you. If so, some karma would be appreciated.

russelljesse
Explorer

Thanks diogofgm, you're right it did not end up being as complex as I thought it would, but I think you're missing some of the conditions, especially "everything else gets th"

I changed it to:
eval ordinal = foo + case((foo>=10 AND foo<=20),"th",foo%10 = 1,"st",foo%10 = 2,"nd",foo%10 = 3,"rd",true(),"th")

The true() will match everything else as yet undefined by the case and give it "th"

However this still doesn't handle foo values ending 11,12,or 13 like 1,112, which will get "1112nd" with the above code.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

I noticed those points when I posted and updated my answer after posting. You probably saw the 1st version.

------------
Hope I was able to help you. If so, some karma would be appreciated.

russelljesse
Explorer

Yep I did, and your new version covers the "everything else" condition AND the ending in 11,12,13. Nice work and thank you for the help.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

please accept it as an answer, so appears to others as answered

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...