Hi All,
I have a Dashboard, with the count of completed requests
COMPLETED | |
46018 | |
12003 | |
1889 | |
1 | |
4 | |
7 | |
TOTAL | 59922 |
if I add the separator
| eval COMPLETED= tostring(COMPLETED, "commas")
COMPLETED | |
46,018 | |
12,003 | |
1,889 | |
1 | |
4 | |
7 | |
TOTAL | 12 |
the total of Dashbord becomes 12. I would like it to become on the total 59,922
how can i solve?
by
Simone
Try this:
| fieldformat COMPLETED=tostring(COMPLETED, "commas")
Hi @ITWhisperer
now I'm in this situation
COMPLETED | |
46,018 | |
12,003 | |
1,889 | |
1 | |
4 | |
7 | |
TOTAL | 59922 |
Is it possible to add formatting to the total as well?
Simone
It should have already worked
| makeresults
| eval _raw=" COMPLETED
46018
12003
1889
1
4
7"
| multikv forceheader=1
| table COMPLETED
| addtotals col=t row=f
| fieldformat COMPLETED=tostring(COMPLETED,"commas")
Which version of splunk are you using?
i am not using the | addtotals col=t row=f but the format visualization on the dash