How to replace high number digits with a letter?

[omri_p]

I have created several dashboards containing high numbers (millions or thousands)
in the dashboard i would like the results to show only the 1 - 2 digits and replace the rest with a dedicated letter (the same as at the glass table)
example:
the dashboard displays a refreshing result of 3,000,000 Millions events ----> i want to display 3M
13,000,000 Millions events ----> i want to display 13M
and the same if the results changes to thonsands

thanks

[niketn]

@omri_p in Splunk Enterprise 7.x has axis abbreviation available which when set to auto, results in closest SI prefix. Refer to documentation:https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Area.2C_Bubble.2...

charting.axisX.abbreviation 
charting.axisY.abbreviation
charting.axisY2.abbreviation 

PS: charting.axisY2.abbreviation is not supported for bubble and scatter charts.

[renjith_nair]

@omri_p ,

Try using case,

| eval formatted_number=case(number>=1000000,round(number/1000000,1),number>=1000000,round(number/100000,1))
| eval unit=case(floor(number/1000000) > 1,"M",floor(number/100000) >1,"K")
| eval number=formatted_number.unit
| fields number

where number is your value field. You may extend the case conditions to cover all possible values

[mihir_hardas]

We need a sophisticated function, convert numeric function that will take care of such conversion of large number in millions, billions as 1.20M , 0.8B

[tfujita_splunk]

I have created macros for frequently used numeric conversions and published them on splunkbase to make them reusable.
It is packaged as a very simple and versatile addon with only about 30 macros.

- bytes to human readable size (e.g. KiB, MiB, GiB, ...)
- number to SI symbol expressions.(e.g. K, M, G, T,...)
- number to language specific expressions.(e.g. million, etc.)

https://splunkbase.splunk.com/app/6595

Usage is on Detail tab in the above web page.