Splunk Search

How to convert a large number to string with expressions of long and short scales, or neither.

Splunk Employee
Splunk Employee

Numeral system macros for Splunk

Examples of Single Value panel and Table.Examples of Single Value panel and Table.

Just an announcement.

I have created macros that converts a number into a string with a language specific expressing (long and short scales, or neither).

It was released on splunkbase.

Language-specific expressions may be useful when displaying huge numbers on a dashboard to make their size easier to understand. Or it may help us to mutually understand how numbers are expressed in other languages.

Ref.: About long and short scales (numeration system).

Example of Use:

Sample for English speakers

| makeresults
| eval val=1234567890123, val=`numeral_en(val)`
| table val
1 trillion 234 billion 567 million 890 thousand 123

Provided macros:

  • numeral_en(1) : Short Scale for English speaker
  • numeral_metric_prefix(1) : Metric prefix. kilo, mega, giga, tera, peta, exa, zetta, yotta
  • numeral_metric_symbol(1) : Metric symbol. K, M, G, T, P, E, Z, Y
  • numeral_jp(1) : 万進法 for Japanese speaker. 千, 万, 億, 兆
  • numeral_kr(1) : for Korean speaker. 千, 萬, 億, 兆
  • numeral_cn_t(1) : Chinese with Traditional Chinese characters. 千, 萬, 億, 兆
  • numeral_cn(1) : Chinese with Simplified Chinese characters. 千, 万, 亿, 兆
  • numeral_in_en(1) : for India, South Asia English. thousand, lakh, crore, lakh crore
  • numeral_in_en2(1) : for India, South Asia English. thousand, lakh, crore, arab
  • numeral_nl(1) : Long Scale for Nederland. duizend, miljoen, miljard, biljoen
  • numeral_fr(1) : Long Scale for French. mille, million, milliard, billion
  • numeral_es(1) : Long Scale for Spanish speaker. mil, millón, millardo, billón
  • numeral_pt(1) : Long Scale for Portuguese speaker. mil, milhão, bilhão, trilhão

Followings also provided since v1.1.1

  • numeral_binary_symbol(1) : Binary symbol. KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB, RiB, QiB
  • numeral_binary_symbol(2) : Binary symbol with arg for rounding digits.

    See Next article "How to convert large bytes to human readable units (e.g. Kib, MiB, GiB)"

More details

See Details tab on https://splunkbase.splunk.com/app/6595

Install this add-on into your search heads.

Advanced examples

Sample usage for using all provided macros.

With rounding lowest 3 digit if over 6 digit.

| makeresults count=35
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val.".".printf("%02d",random()%100)
| foreach metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr [eval <<FIELD>>=val]
| table digit val metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr
| fieldformat val=tostring(val,"commas")
| fieldformat metric_prefix=`numeral_metric_prefix(if(log(metric_prefix,10)>6,round(metric_prefix,-3),metric_prefix))`
| fieldformat metric_symbol=`numeral_metric_symbol(if(log(metric_symbol,10)>6,round(metric_symbol,-3),metric_symbol))`
| fieldformat binary_symbol=printf("% 10s",`numeral_binary_symbol(binary_symbol,2)`)
| fieldformat en=`numeral_en(if(log(en,10)>6,round(en,-3),en))`
| fieldformat es=`numeral_es(if(log(es,10)>6,round(es,-3),es))`
| fieldformat pt=`numeral_pt(if(log(pt,10)>6,round(pt,-3),pt))`
| fieldformat in_en=`numeral_in_en(if(log(in_en,10)>6,round(in_en,-3),in_en))`
| fieldformat in_en2=`numeral_in_en2(if(log(in_en2,10)>6,round(in_en2,-3),in_en2))`
| fieldformat jp=`numeral_jp(if(log(jp,10)>6,round(jp,-3),jp))`
| fieldformat kr=`numeral_kr(if(log(kr,10)>6,round(kr,-3),kr))`
| fieldformat cn_t=`numeral_cn_t(if(log(cn_t,10)>6,round(cn_t,-3),cn_t))`
| fieldformat cn=`numeral_cn(if(log(cn,10)>6,round(cn,-3),cn))`
| fieldformat nl=`numeral_nl(if(log(nl,10)>6,round(nl,-3),nl))`
| fieldformat fr=`numeral_fr(if(log(fr,10)>6,round(fr,-3),fr))`

The results of this search will look like the table in the top image of this article.

Labels (3)
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...