Splunk Search

How to convert a large number to string with expressions of long and short scales, or neither.

tfujita_splunk
Splunk Employee
Splunk Employee

Numeral system macros for Splunk

Examples of Single Value panel and Table.Examples of Single Value panel and Table.

Hello,
Just an announcement.

I have created macros that converts a number into a string with a language specific expressing (long and short scales, or neither).

It was released on splunkbase.
https://splunkbase.splunk.com/app/6595

Language-specific expressions may be useful when displaying huge numbers on a dashboard to make their size easier to understand. Or it may help us to mutually understand how numbers are expressed in other languages.

Ref.: About long and short scales (numeration system).
https://en.wikipedia.org/wiki/Long_and_short_scales

Example of Use:

Sample for English speakers

| makeresults
| eval val=1234567890123, val=`numeral_en(val)`
| table val
1 trillion 234 billion 567 million 890 thousand 123

Provided macros:

  • numeral_en(1) : Short Scale for English speaker
  • numeral_metric_prefix(1) : Metric prefix. kilo, mega, giga, tera, peta, exa, zetta, yotta
  • numeral_metric_symbol(1) : Metric symbol. K, M, G, T, P, E, Z, Y
  • numeral_jp(1) : 万進法 for Japanese speaker. 千, 万, 億, 兆
  • numeral_kr(1) : for Korean speaker. 千, 萬, 億, 兆
  • numeral_cn_t(1) : Chinese with Traditional Chinese characters. 千, 萬, 億, 兆
  • numeral_cn(1) : Chinese with Simplified Chinese characters. 千, 万, 亿, 兆
  • numeral_in_en(1) : for India, South Asia English. thousand, lakh, crore, lakh crore
  • numeral_in_en2(1) : for India, South Asia English. thousand, lakh, crore, arab
  • numeral_nl(1) : Long Scale for Nederland. duizend, miljoen, miljard, biljoen
  • numeral_fr(1) : Long Scale for French. mille, million, milliard, billion
  • numeral_es(1) : Long Scale for Spanish speaker. mil, millón, millardo, billón
  • numeral_pt(1) : Long Scale for Portuguese speaker. mil, milhão, bilhão, trilhão

Followings also provided since v1.1.1

  • numeral_binary_symbol(1) : Binary symbol. KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB, RiB, QiB
  • numeral_binary_symbol(2) : Binary symbol with arg for rounding digits.

    See Next article "How to convert large bytes to human readable units (e.g. Kib, MiB, GiB)"

More details

See Details tab on https://splunkbase.splunk.com/app/6595

Install this add-on into your search heads.

Advanced examples

Sample usage for using all provided macros.

With rounding lowest 3 digit if over 6 digit.

| makeresults count=35
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val.".".printf("%02d",random()%100)
| foreach metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr [eval <<FIELD>>=val]
| table digit val metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr
| fieldformat val=tostring(val,"commas")
| fieldformat metric_prefix=`numeral_metric_prefix(if(log(metric_prefix,10)>6,round(metric_prefix,-3),metric_prefix))`
| fieldformat metric_symbol=`numeral_metric_symbol(if(log(metric_symbol,10)>6,round(metric_symbol,-3),metric_symbol))`
| fieldformat binary_symbol=printf("% 10s",`numeral_binary_symbol(binary_symbol,2)`)
| fieldformat en=`numeral_en(if(log(en,10)>6,round(en,-3),en))`
| fieldformat es=`numeral_es(if(log(es,10)>6,round(es,-3),es))`
| fieldformat pt=`numeral_pt(if(log(pt,10)>6,round(pt,-3),pt))`
| fieldformat in_en=`numeral_in_en(if(log(in_en,10)>6,round(in_en,-3),in_en))`
| fieldformat in_en2=`numeral_in_en2(if(log(in_en2,10)>6,round(in_en2,-3),in_en2))`
| fieldformat jp=`numeral_jp(if(log(jp,10)>6,round(jp,-3),jp))`
| fieldformat kr=`numeral_kr(if(log(kr,10)>6,round(kr,-3),kr))`
| fieldformat cn_t=`numeral_cn_t(if(log(cn_t,10)>6,round(cn_t,-3),cn_t))`
| fieldformat cn=`numeral_cn(if(log(cn,10)>6,round(cn,-3),cn))`
| fieldformat nl=`numeral_nl(if(log(nl,10)>6,round(nl,-3),nl))`
| fieldformat fr=`numeral_fr(if(log(fr,10)>6,round(fr,-3),fr))`

The results of this search will look like the table in the top image of this article.

Labels (3)
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...