Splunk Search

Format with commas an |appendpipe [stats sum(*) as * by Number ...

BeautyData
Engager

Good afternoon everyone, I need your help in this way. I have a stats sum with the wild card *

|appendpipe [stats sum(*) as * by Number | eval UserName="Total By Number: "]


and I need to format with commas the sum(*) as *.

How I can do that?

Thank you

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
If you want just format those on display but not convert those to string then you should use command fielformat instead of eval inside foreach loop.
I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop. If it didn't work then just use additional field name with eval and you could use original for calculations later.

View solution in original post

0 Karma

BeautyData
Engager

Hi! thank you for responding soon! I appreciate that.

I am trying to put commas formatting to my  Totals Row that I builds with this : | appendpipe [stats sum(*) as * by Number | eval UserName="Total By Number: "]

This is my row now:

--------------------------------------------------------------------------------------------
Total By Number:        1905           2229         1303         1845          1409
--------------------------------------------------------------------------------------------

 

This is the row that I am looking for the formatting way :

--------------------------------------------------------------------------------------------
Total By Number:        1,905           2,229         13,03         1,845          1,409
--------------------------------------------------------------------------------------------

 

Thank you

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

That's the job for tostring.

| appendpipe
    [stats sum(*) as * by Number
    | foreach *
        [eval <<FIELD>> = tostring(<<FIELD>>, "commas")]
    | eval UserName="Total By Number: "]

I'm not sure why you group by "Number" but evals "UserName". 

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you want just format those on display but not convert those to string then you should use command fielformat instead of eval inside foreach loop.
I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop. If it didn't work then just use additional field name with eval and you could use original for calculations later.
0 Karma

yuanliu
SplunkTrust
SplunkTrust
I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop.

Nope.  These are from 9.2.0.1.

foreach-eval.png

foreach-fieldformat.png

I begin to suspect that this is by design.

  

ITWhisperer
SplunkTrust
SplunkTrust

If it is in a dashboard, you could try the thousands separator option

0 Karma

BeautyData
Engager

It is a report. I did try with the format in the UI but this will lost when this run again with different dates.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear to me what your expected output would look like. Please can you share an example?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...