Dashboards & Visualizations

limited formatting options when using fieldformat?

mitag
Contributor

Is applying (retaining?) conditional numerical value-based field formatting after applying fieldformat that normalizes the values - an option? (It appears not?)

no fieldformat: right-justfied as it shouldno fieldformat: right-justfied as it should  after fieldformat: left justifiedafter fieldformat: left justified

Hope it's clear why neither option is satisfactory: fields with fieldformat applied - are left justified and with no (numerical) value-based conditional formatting making it counter-intuitive and generally unreadable. Fields w/o fieldformat: can quickly and irrevocably get unreadable as they can easily get into petabytes depending on the search timeframe and how busy the application has been.

For comparison, this is from a much younger competing product enabling auto formatting and normalizing data in ways that appear to be missing in Splunk: 

Datadog - Screen Shot 2020-08-17 at 2.34.24 PM.png

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once you applied the fieldformat, the numbers (which are always right-justified) became a string (which are left-justified).
Perhaps the printf function will help. See https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/ConversionFunctions

---
If this reply helps you, an upvote would be appreciated.
0 Karma

mitag
Contributor

printf can't right-justify a string, correct? So printf isn't applicable here?

(Sure, tostring's output may stay right-justified - yet conditional color formatting? Gone.)

The use case in my question, to make both large and small numbers readable in the same table using unit prefixes (aka multipliers like "kilo", "mega", etc.)? Dead in the water. Yet arguably this is Splunk's #1 job: "make data actionable" - which can't be done w/o making data readable.

Splunk does a fairly decent job with conditional color formatting on numerals in a table - I don't see similar options in the competing product I mentioned in my OP.

conditional color formatting for numerals in a tableconditional color formatting for numerals in a table

Yet losing those formatting options the moment I try to make those numerals readable beyond what's available in column formatting? Find it hard to fathom.

P.S. I get the part about formatting strings vs. numerals - it's all over Splunk Answers including in the answer I've linked to in my OP. Perhaps it's too much to ask for Splunk to do conditional formatting based on raw values rather than formatted ones. Yet at least give me an option to right-justify a string w/o going to a CSS? Better yet, add unit prefixes to conditional formatting options?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm sure of all of printf's functionality.  I know it can left-justify and was hoping it could right-justify.

Consider making your suggestions at https://ideas.splunk.com

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!