Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Adding commas to "stats sum"
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'm trying to add commas to the TotalPrints field as shown in the code below. I have tried the fieldformat=stringto but it just creates an empty additional TotalPrints field. Can someone please advise?
Also a quick one, how can I make the TotalPrints in descending order and limit it top top 10? I have tried sort- and limite=10 but it doesnt appear to do anything..
source="PrinterDemo.csv"
| multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints
| stats sum(TotalPrints) by "Location"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks very much 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Alternatively, you could use | fieldformat sum(TotalPrints) = tostring('sum(TotalPrints)', "commas") but I prefer somesoni2's approach!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yup... at the end I've added
| fieldformat TotalPrints=tostring(TotalPrints,"commas")
and
|fieldformat "sum(TotalPrints)"=tostring(TotalPrints,"commas")
no joy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you show what your search string when you tried to use fieldformat looked like?
Fall Into Learning with New Splunk Education Courses
Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...
How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes
