Splunk Enterprise

Having a space as the thousands separator, and be able to order when you click on the column

alvesri
Engager

Hi guys can you please help me ?

I'm trying to use a space as thousands separator and I can't, the max that I could it's a comma with this:

 eval value= if(value!="N/A",printf("%'d",value),value)


Result = 123,456

so I guess I can change it with a replace maybe,

But then we have problem number 2 ,

When I try to sort the by value in the arrow of the column, the sort it isn't correct, and the bigger numbers are considerate as strings. 

Can you guys help me solve this please ?

Tell me if you need more things 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| fieldformat value=replace(tostring(value,"commas"),","," ")

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you should look

  • fieldformat
  • tostring(var,”commas”)

which fulfills your requirement.

r. Ismo

0 Karma

alvesri
Engager

Hi thank you for the reply,

I tried that, and it works replacing the comma with a space, but the issue it's next when i click on the column to sort in a descending order, and the numbers are not sorted correctly, because some of them are string and others are numbers, and I tried the conversion "tonumber()" 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Fieldformat is just to keep those values as numbers instead of covert those to string as happened with eval.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fieldformat value=replace(tostring(value,"commas"),","," ")

alvesri
Engager

Hi guys,

I did this ant it worked in replacing the comma, thank you. 
The N/A is in case i'ts empty.

| eval value= if(value!="N/A", replace(tostring(value,"commas"),","," "),value)

But the thing is, I can't order it correctly. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...