Splunk Search

Format results with comma thousands separator

Oren
Explorer

How do I format the output to have comma separators - I want 1,234,567, not 1234567. Any easy way?

Given a query like:

eventtype=request | sistats sum(http_bytes) as bytes by http_domain | sort -bytes | head 100

I'd like bytes to be more human readable.

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the tostring(X, "commas") function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions):

eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100

View solution in original post

juanxiayan
Explorer

If you said that, I can't draw chart(or graph).

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the tostring(X, "commas") function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions):

eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...