Dashboards & Visualizations

limited formatting options when using fieldformat?

mitag
Contributor

Is applying (retaining?) conditional numerical value-based field formatting after applying fieldformat that normalizes the values - an option? (It appears not?)

no fieldformat: right-justfied as it shouldno fieldformat: right-justfied as it should  after fieldformat: left justifiedafter fieldformat: left justified

Hope it's clear why neither option is satisfactory: fields with fieldformat applied - are left justified and with no (numerical) value-based conditional formatting making it counter-intuitive and generally unreadable. Fields w/o fieldformat: can quickly and irrevocably get unreadable as they can easily get into petabytes depending on the search timeframe and how busy the application has been.

For comparison, this is from a much younger competing product enabling auto formatting and normalizing data in ways that appear to be missing in Splunk: 

Datadog - Screen Shot 2020-08-17 at 2.34.24 PM.png

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once you applied the fieldformat, the numbers (which are always right-justified) became a string (which are left-justified).
Perhaps the printf function will help. See https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/ConversionFunctions

---
If this reply helps you, Karma would be appreciated.
0 Karma

mitag
Contributor

printf can't right-justify a string, correct? So printf isn't applicable here?

(Sure, tostring's output may stay right-justified - yet conditional color formatting? Gone.)

The use case in my question, to make both large and small numbers readable in the same table using unit prefixes (aka multipliers like "kilo", "mega", etc.)? Dead in the water. Yet arguably this is Splunk's #1 job: "make data actionable" - which can't be done w/o making data readable.

Splunk does a fairly decent job with conditional color formatting on numerals in a table - I don't see similar options in the competing product I mentioned in my OP.

conditional color formatting for numerals in a tableconditional color formatting for numerals in a table

Yet losing those formatting options the moment I try to make those numerals readable beyond what's available in column formatting? Find it hard to fathom.

P.S. I get the part about formatting strings vs. numerals - it's all over Splunk Answers including in the answer I've linked to in my OP. Perhaps it's too much to ask for Splunk to do conditional formatting based on raw values rather than formatted ones. Yet at least give me an option to right-justify a string w/o going to a CSS? Better yet, add unit prefixes to conditional formatting options?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm sure of all of printf's functionality.  I know it can left-justify and was hoping it could right-justify.

Consider making your suggestions at https://ideas.splunk.com

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...