Splunk Search

How to add a comma separator to field numeric values using fieldformat command?

tmurray3
Path Finder

Have have a query that creates a timechart. I want to add a comma separator to the field numeric values. When I run the query it adds an extra field, plus the numeric values are not formatted.

Here is the query:

index=service_hourly_summary report="bystatus" earliest=-2w@w latest=@w|timechart span=1w sum(count) by status|rename _time as time |eval time=strftime(time,"%m/%d") | rename time as WeekOf|fieldformat status=tostring(status,"commas")| addtotals col=true row=false labelfield="Total Volume"| table WeekOf,*,"Total Volume"

       WeekOf FAILED SUCCESS  Total Volume   status
1      08/24   7577    66548
2      08/31   6882    58116
3              14459   24664  Total

Status has two values FAILED or SUCCESS, but I can't get the field formatted with commas. Also, is there a way to get rid of the Total Volume header, but keep the Total label in row 3?

Thanks in advance for your help!!

Tags (1)
1 Solution

kmattern
Builder

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals

View solution in original post

kmattern
Builder

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...