Splunk Search

How do you convert numeric value from 5000 to 5k for a field?

arrangineni
Path Finder

I am planning to convert the value of a count into 5k, 500k format rather than the whole number. May I know how I can achieve this? I am trying to use this in Single value panel in a Splunk dashboard. Currently my query looks as follows

.........| timechart span=1mon count
Tags (2)
0 Karma
1 Solution

osakachan
Communicator

Hi @arrangineni,

Maybe this way can help. Do not know if there is a better way.

| eval count=round((count / 1000),0)
| eval count=count + "k"

View solution in original post

0 Karma

osakachan
Communicator

Hi @arrangineni,

Maybe this way can help. Do not know if there is a better way.

| eval count=round((count / 1000),0)
| eval count=count + "k"
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...