Splunk Search

How to use thousand comma separator for chart command?

ND
Path Finder

Hi Everyone,

 

below is my query to use thousand comma separator:

|inputlookup abc.csv | chart sum(field1) as field1 by field2, field3| addtotals | fieldformat/eval = tostring(field1, "commas").

 

in the result I am not getting commas in the field1 value. If I alter my query with only 1 field -> field2 or field3 then I get expected result. but I want sum of field by field 2 and field 3.

can someone help me with this issue?

Thanks,

ND.

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ND 

Can you please try this?

| inputlookup abc.csv 
| chart sum(field1) as field1 by field2, field3 
| addtotals 
| eval field1 = tostring(field1, "commas") 

 

For further help can you please share sample output of below search?

| inputlookup abc.csv 
| chart sum(field1) as field1 by field2, field3 
| addtotals 
 

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...