Splunk Search

Format results with comma thousands separator

Oren
Explorer

How do I format the output to have comma separators - I want 1,234,567, not 1234567. Any easy way?

Given a query like:

eventtype=request | sistats sum(http_bytes) as bytes by http_domain | sort -bytes | head 100

I'd like bytes to be more human readable.

0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the tostring(X, "commas") function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions):

eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100

View solution in original post

juanxiayan
Explorer

If you said that, I can't draw chart(or graph).

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the tostring(X, "commas") function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions):

eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...