Splunk Search
Highlighted

Add a data size notation to the end of a value?

Communicator

So the following will add a $ symbol to the beginning of the value Revenue, like "$ 42"

... | eval Revenue="$ ".tostring(Revenue,"commas")

How do you add data size notations like MB or GB to the end of a value like "42 MB"

Thanks in advance for any help

I-Man

Tags (1)
0 Karma
Highlighted

Re: Add a data size notation to the end of a value?

Splunk Employee
Splunk Employee

same method, concatenate the values.

| eval myvaluewithnotation=myvalue."MB"

View solution in original post

Highlighted

Re: Add a data size notation to the end of a value?

Communicator

Ahh thanks. Out of curiosity, do you know what the period does prior to the "MB"?

0 Karma
Highlighted

Re: Add a data size notation to the end of a value?

Splunk Employee
Splunk Employee

the "period" is for concatenation. You can concatenate strings and field.
"A"."B"."C" => "ABC"

Highlighted

Re: Add a data size notation to the end of a value?

Explorer

But this thing is not working in visualization , for visualization adding "Value"."MB" how we can do ?

0 Karma