Splunk Search

How to convert a large number to string with expressions of long and short scales, or neither.

tfujita_splunk
Splunk Employee
Splunk Employee

Numeral system macros for Splunk

Examples of Single Value panel and Table.Examples of Single Value panel and Table.

Hello,
Just an announcement.

I have created macros that converts a number into a string with a language specific expressing (long and short scales, or neither).

It was released on splunkbase.
https://splunkbase.splunk.com/app/6595

Language-specific expressions may be useful when displaying huge numbers on a dashboard to make their size easier to understand. Or it may help us to mutually understand how numbers are expressed in other languages.

Ref.: About long and short scales (numeration system).
https://en.wikipedia.org/wiki/Long_and_short_scales

Example of Use:

Sample for English speakers

| makeresults
| eval val=1234567890123, val=`numeral_en(val)`
| table val
1 trillion 234 billion 567 million 890 thousand 123

Provided macros:

  • numeral_en(1) : Short Scale for English speaker
  • numeral_metric_prefix(1) : Metric prefix. kilo, mega, giga, tera, peta, exa, zetta, yotta
  • numeral_metric_symbol(1) : Metric symbol. K, M, G, T, P, E, Z, Y
  • numeral_jp(1) : 万進法 for Japanese speaker. 千, 万, 億, 兆
  • numeral_kr(1) : for Korean speaker. 千, 萬, 億, 兆
  • numeral_cn_t(1) : Chinese with Traditional Chinese characters. 千, 萬, 億, 兆
  • numeral_cn(1) : Chinese with Simplified Chinese characters. 千, 万, 亿, 兆
  • numeral_in_en(1) : for India, South Asia English. thousand, lakh, crore, lakh crore
  • numeral_in_en2(1) : for India, South Asia English. thousand, lakh, crore, arab
  • numeral_nl(1) : Long Scale for Nederland. duizend, miljoen, miljard, biljoen
  • numeral_fr(1) : Long Scale for French. mille, million, milliard, billion
  • numeral_es(1) : Long Scale for Spanish speaker. mil, millón, millardo, billón
  • numeral_pt(1) : Long Scale for Portuguese speaker. mil, milhão, bilhão, trilhão

Followings also provided since v1.1.1

  • numeral_binary_symbol(1) : Binary symbol. KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB, RiB, QiB
  • numeral_binary_symbol(2) : Binary symbol with arg for rounding digits.

    See Next article "How to convert large bytes to human readable units (e.g. Kib, MiB, GiB)"

More details

See Details tab on https://splunkbase.splunk.com/app/6595

Install this add-on into your search heads.

Advanced examples

Sample usage for using all provided macros.

With rounding lowest 3 digit if over 6 digit.

| makeresults count=35
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val.".".printf("%02d",random()%100)
| foreach metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr [eval <<FIELD>>=val]
| table digit val metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr
| fieldformat val=tostring(val,"commas")
| fieldformat metric_prefix=`numeral_metric_prefix(if(log(metric_prefix,10)>6,round(metric_prefix,-3),metric_prefix))`
| fieldformat metric_symbol=`numeral_metric_symbol(if(log(metric_symbol,10)>6,round(metric_symbol,-3),metric_symbol))`
| fieldformat binary_symbol=printf("% 10s",`numeral_binary_symbol(binary_symbol,2)`)
| fieldformat en=`numeral_en(if(log(en,10)>6,round(en,-3),en))`
| fieldformat es=`numeral_es(if(log(es,10)>6,round(es,-3),es))`
| fieldformat pt=`numeral_pt(if(log(pt,10)>6,round(pt,-3),pt))`
| fieldformat in_en=`numeral_in_en(if(log(in_en,10)>6,round(in_en,-3),in_en))`
| fieldformat in_en2=`numeral_in_en2(if(log(in_en2,10)>6,round(in_en2,-3),in_en2))`
| fieldformat jp=`numeral_jp(if(log(jp,10)>6,round(jp,-3),jp))`
| fieldformat kr=`numeral_kr(if(log(kr,10)>6,round(kr,-3),kr))`
| fieldformat cn_t=`numeral_cn_t(if(log(cn_t,10)>6,round(cn_t,-3),cn_t))`
| fieldformat cn=`numeral_cn(if(log(cn,10)>6,round(cn,-3),cn))`
| fieldformat nl=`numeral_nl(if(log(nl,10)>6,round(nl,-3),nl))`
| fieldformat fr=`numeral_fr(if(log(fr,10)>6,round(fr,-3),fr))`

The results of this search will look like the table in the top image of this article.

Labels (3)
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...