Dashboards & Visualizations

Is there a smart conversion of large numbers to human readable for use on dashboard?

alfski
New Member

Hi, is there a splunk equivalent to the Linux "numfmt" command?

I have a dashboard showing disk usage, captured in bytes. And I want to display the number in "human readable format", some disks will be Mb, Gb, some will be Tb. I'd prefer to not simply divide by 1024. 

I'm guessing there's a clever number formatter in splunk like there is in Linux?

 

 

 

$ numfmt --to=si 122345
123K
$ numfmt --to=si 122345678
123M
$ numfmt --to=si 1223456789012
1.3T

 

 

 

Cheers, Andrew

Labels (1)
Tags (1)
0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

Perhaps this could be a solution.

| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach si [eval <<FIELD>>=val]
| table digit val si
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat si=printf("% 7.2f",round(si/pow(1024,if(si=0,0,floor(min(log(si,1024),10)))),2)).case(si=0 OR log(si,1024)<1," B", log(si,1024)<2," KiB", log(si,1024)<3," MiB", log(si,1024)<4," GiB", log(si,1024)<5," TiB", log(si,1024)<6," PiB", log(si,1024)<7," EiB", log(si,1024)<8," ZiB", log(si,1024)<9," YiB", log(si,1024)<10," RiB", log(si,1024)<11," QiB", 1=1, " QiB")

tfujita_splunk_0-1675477308718.png

 

If you wish to achieve something similar in decimal rather than in 1024-byte units, the following macros can be useful.

Numeral system macros for Splunk

https://splunkbase.splunk.com/app/6595


Usage:

How to convert a large number to string with expressions of long and short scales, or neither.

https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio...

 

0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

I added macros for binary symbols to the add-on Numeral system macros for Splunk v1.1.1 

Now you can also use macros numeral_binary_symbol(1) or numeral_binary_symbol(2).

Example

| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach bytes [eval <<FIELD>>=val]
| table digit val bytes
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I don't believe there's a way to convert that way found, but you can always create a macro so it would be simple within the SPL

 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...