I have created several dashboards containing high numbers (millions or thousands)
in the dashboard i would like the results to show only the 1 - 2 digits and replace the rest with a dedicated letter (the same as at the glass table)
the dashboard displays a refreshing result of 3,000,000 Millions events ----> i want to display 3M
13,000,000 Millions events ----> i want to display 13M
and the same if the results changes to thonsands
@omri_p in Splunk Enterprise 7.x has axis abbreviation available which when set to
auto, results in closest SI prefix. Refer to documentation:https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Area.2C_Bubble.2...
charting.axisX.abbreviation charting.axisY.abbreviation charting.axisY2.abbreviation
PS: charting.axisY2.abbreviation is not supported for bubble and scatter charts.
Try using case,
| eval formatted_number=case(number>=1000000,round(number/1000000,1),number>=1000000,round(number/100000,1)) | eval unit=case(floor(number/1000000) > 1,"M",floor(number/100000) >1,"K") | eval number=formatted_number.unit | fields number
number is your value field. You may extend the case conditions to cover all possible values