Splunk Search

How to keep the number on the right side after changing the commas with space to match canadian number format?

usernamejpblais
Engager

Hello Splunker!

I added the "tostring + commas" to a number to get the thousand separator. Work's fine.

The problem is when I do the rex command to replace the commas with a space to match the canadian format number, my numbers get shifted on the left side. Is there another way to do so, so I can keep my number on the right side? See code below:

| eval sum_totrows=tostring(sum_totalrows,"commas")
| rex field=sum_totrows mode=sed "s/,/ /g"

Result:
407 930
119
14 131
...

Thanks!

0 Karma

to4kawa
Ultra Champion

Canadian style
that's interesting

| eval sum_totrows=replace(tostring(sum_totalrows,"commas"),","," ")
one liner.

0 Karma

usernamejpblais
Engager

I like that one liner but I have the same problem, number shift to the left.

0 Karma

to4kawa
Ultra Champion

That's exactly what @richgalloway says.
Creating dashboard can use js and css, maybe we can.
but I don't know. ask another experts.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is justification setting in Splunk. Numbers are automatically right-justified and strings are left-justified (at least in the US locale). Putting spaces in numbers converts them to strings so that is why they are left-justified.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

usernamejpblais
Engager

Ok I understand, so is there a way to configure the setting to change the thousand separator from commas to space?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I am not aware of one.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!