Splunk Search

Format with commas an |appendpipe [stats sum(*) as * by Number ...

BeautyData
Explorer

Good afternoon everyone, I need your help in this way. I have a stats sum with the wild card *

|appendpipe [stats sum(*) as * by Number | eval UserName="Total By Number: "]


and I need to format with commas the sum(*) as *.

How I can do that?

Thank you

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
If you want just format those on display but not convert those to string then you should use command fielformat instead of eval inside foreach loop.
I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop. If it didn't work then just use additional field name with eval and you could use original for calculations later.

View solution in original post

0 Karma

BeautyData
Explorer

Hi! thank you for responding soon! I appreciate that.

I am trying to put commas formatting to my  Totals Row that I builds with this : | appendpipe [stats sum(*) as * by Number | eval UserName="Total By Number: "]

This is my row now:

--------------------------------------------------------------------------------------------
Total By Number:        1905           2229         1303         1845          1409
--------------------------------------------------------------------------------------------

 

This is the row that I am looking for the formatting way :

--------------------------------------------------------------------------------------------
Total By Number:        1,905           2,229         13,03         1,845          1,409
--------------------------------------------------------------------------------------------

 

Thank you

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

That's the job for tostring.

| appendpipe
    [stats sum(*) as * by Number
    | foreach *
        [eval <<FIELD>> = tostring(<<FIELD>>, "commas")]
    | eval UserName="Total By Number: "]

I'm not sure why you group by "Number" but evals "UserName". 

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you want just format those on display but not convert those to string then you should use command fielformat instead of eval inside foreach loop.
I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop. If it didn't work then just use additional field name with eval and you could use original for calculations later.
0 Karma

yuanliu
SplunkTrust
SplunkTrust
I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop.

Nope.  These are from 9.2.0.1.

foreach-eval.png

foreach-fieldformat.png

I begin to suspect that this is by design.

  

ITWhisperer
SplunkTrust
SplunkTrust

If it is in a dashboard, you could try the thousands separator option

0 Karma

BeautyData
Explorer

It is a report. I did try with the format in the UI but this will lost when this run again with different dates.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear to me what your expected output would look like. Please can you share an example?

0 Karma
Get Updates on the Splunk Community!

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...