hi there, I need to add decimal comma separation for a long number such as 2546788 that is, 2,546,788
Then I need to concatenate a string such as " JAN" + "2,546,788" in the final results. Here is my code.
I just need to add the commas:
source=*DT* index=freewheel sourcetype=delta earliest=-1mon@mon latest=@mon
| convert rmcomma("duration")
| eval previous_month = strftime(relative_time(now(), "-1mon"), "%b")
| eventstats sum("duration") as Ads
| fieldformat amount= "$" + tostring(Ads, "commas") <=== this is not working
| eval results = previous_month + ": " + Ads
| table results amount
Thank you
You are using command fieldformat, which just updates the display format of the value but not the underlying value. You should use EVAL instead.
source=DT index=freewheel sourcetype=delta earliest=-1mon@mon latest=@mon
| convert rmcomma("duration")
| eval previous_month = strftime(relative_time(now(), "-1mon"), "%b")
| eventstats sum("duration") as Ads
| eval amount= "$" + tostring(Ads, "commas") | eval results = previous_month + ": " + Ads
| table results amount
You are using command fieldformat, which just updates the display format of the value but not the underlying value. You should use EVAL instead.
source=DT index=freewheel sourcetype=delta earliest=-1mon@mon latest=@mon
| convert rmcomma("duration")
| eval previous_month = strftime(relative_time(now(), "-1mon"), "%b")
| eventstats sum("duration") as Ads
| eval amount= "$" + tostring(Ads, "commas") | eval results = previous_month + ": " + Ads
| table results amount
eval amount= "$" + tostring(amount, "commas")
ty
oh crap and I thought I had tried that...guess not. Thanks bud