How to add a comma separator to field numeric values using fieldformat command?

[tmurray3]

Have have a query that creates a timechart. I want to add a comma separator to the field numeric values. When I run the query it adds an extra field, plus the numeric values are not formatted.

Here is the query:

index=service_hourly_summary report="bystatus" earliest=-2w@w latest=@w|timechart span=1w sum(count) by status|rename _time as time |eval time=strftime(time,"%m/%d") | rename time as WeekOf|fieldformat status=tostring(status,"commas")| addtotals col=true row=false labelfield="Total Volume"| table WeekOf,*,"Total Volume"

       WeekOf FAILED SUCCESS  Total Volume   status
1      08/24   7577    66548
2      08/31   6882    58116
3              14459   24664  Total

Status has two values FAILED or SUCCESS, but I can't get the field formatted with commas. Also, is there a way to get rid of the Total Volume header, but keep the Total label in row 3?

Thanks in advance for your help!!

[kmattern · Accepted solution]

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals