Splunk Search

How to format fields globally based on the data type used?

Path Finder


Is there any way by which I can set the formatting at once central place and it takes effect wherever that data type is used. For example, I define types like US_CURRENCY, NUMBER_WITH_COMMAS, etc...and then in query I can simply mark the field to be US_CURRENCY so that it is represented as $389.90 instead of 380.90

Any pointers would be appreciated

thanks, ronak

0 Karma


You could create a macro US_CURRENCY(1) that takes the field as its argument and is defined something like this:

fieldformat $field$ = "$$".'$field$'

and use it in your searches like this:

some search | `US_CURRENCY(total)` | ...
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...