Splunk Search

Add a data size notation to the end of a value?

I-Man
Communicator

So the following will add a $ symbol to the beginning of the value Revenue, like "$ 42"

... | eval Revenue="$ ".tostring(Revenue,"commas")

How do you add data size notations like MB or GB to the end of a value like "42 MB"

Thanks in advance for any help

I-Man

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

same method, concatenate the values.

| eval myvaluewithnotation=myvalue."MB"

View solution in original post

erritesh17
Path Finder

But this thing is not working in visualization , for visualization adding "Value"."MB" how we can do ?

0 Karma

yannK
Splunk Employee
Splunk Employee

same method, concatenate the values.

| eval myvaluewithnotation=myvalue."MB"

yannK
Splunk Employee
Splunk Employee

the "period" is for concatenation. You can concatenate strings and field.
"A"."B"."C" => "ABC"

I-Man
Communicator

Ahh thanks. Out of curiosity, do you know what the period does prior to the "MB"?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...