Splunk Search

How to use thousand comma separator for chart command?

ND
Path Finder

Hi Everyone,

 

below is my query to use thousand comma separator:

|inputlookup abc.csv | chart sum(field1) as field1 by field2, field3| addtotals | fieldformat/eval = tostring(field1, "commas").

 

in the result I am not getting commas in the field1 value. If I alter my query with only 1 field -> field2 or field3 then I get expected result. but I want sum of field by field 2 and field 3.

can someone help me with this issue?

Thanks,

ND.

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ND 

Can you please try this?

| inputlookup abc.csv 
| chart sum(field1) as field1 by field2, field3 
| addtotals 
| eval field1 = tostring(field1, "commas") 

 

For further help can you please share sample output of below search?

| inputlookup abc.csv 
| chart sum(field1) as field1 by field2, field3 
| addtotals 
 

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...