Splunk Search

How to add certain character to a search result (Number)?

aryamehr360
New Member

I want to reformat any number of my search result to kWh ; as you see in pictures below for example 15 to 15 kWh.

alt text

Labels (1)
Tags (1)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You want to add text to your numerical field? If so then it would be as simple as

| eval Average-kWh=Average-kWh." kWh"

Splunk may not like the - in the field name. If it complains about this, change the name on line 7 to something like Average_kWh then rename after the eval I pasted above

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You want to add text to your numerical field? If so then it would be as simple as

| eval Average-kWh=Average-kWh." kWh"

Splunk may not like the - in the field name. If it complains about this, change the name on line 7 to something like Average_kWh then rename after the eval I pasted above

View solution in original post

0 Karma

aryamehr360
New Member

Yes it work the issue was idd the - in the field name,
thanks.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!