Dashboards & Visualizations

Is there a smart conversion of large numbers to human readable for use on dashboard?

alfski
New Member

Hi, is there a splunk equivalent to the Linux "numfmt" command?

I have a dashboard showing disk usage, captured in bytes. And I want to display the number in "human readable format", some disks will be Mb, Gb, some will be Tb. I'd prefer to not simply divide by 1024. 

I'm guessing there's a clever number formatter in splunk like there is in Linux?

 

 

 

$ numfmt --to=si 122345
123K
$ numfmt --to=si 122345678
123M
$ numfmt --to=si 1223456789012
1.3T

 

 

 

Cheers, Andrew

Labels (1)
Tags (1)
0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

Perhaps this could be a solution.

| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach si [eval <<FIELD>>=val]
| table digit val si
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat si=printf("% 7.2f",round(si/pow(1024,if(si=0,0,floor(min(log(si,1024),10)))),2)).case(si=0 OR log(si,1024)<1," B", log(si,1024)<2," KiB", log(si,1024)<3," MiB", log(si,1024)<4," GiB", log(si,1024)<5," TiB", log(si,1024)<6," PiB", log(si,1024)<7," EiB", log(si,1024)<8," ZiB", log(si,1024)<9," YiB", log(si,1024)<10," RiB", log(si,1024)<11," QiB", 1=1, " QiB")

tfujita_splunk_0-1675477308718.png

 

If you wish to achieve something similar in decimal rather than in 1024-byte units, the following macros can be useful.

Numeral system macros for Splunk

https://splunkbase.splunk.com/app/6595


Usage:

How to convert a large number to string with expressions of long and short scales, or neither.

https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio...

 

0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

I added macros for binary symbols to the add-on Numeral system macros for Splunk v1.1.1 

Now you can also use macros numeral_binary_symbol(1) or numeral_binary_symbol(2).

Example

| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach bytes [eval <<FIELD>>=val]
| table digit val bytes
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I don't believe there's a way to convert that way found, but you can always create a macro so it would be simple within the SPL

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...