Splunk Search

How to use thousand comma separator for chart command?

ND
Path Finder

Hi Everyone,

 

below is my query to use thousand comma separator:

|inputlookup abc.csv | chart sum(field1) as field1 by field2, field3| addtotals | fieldformat/eval = tostring(field1, "commas").

 

in the result I am not getting commas in the field1 value. If I alter my query with only 1 field -> field2 or field3 then I get expected result. but I want sum of field by field 2 and field 3.

can someone help me with this issue?

Thanks,

ND.

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ND 

Can you please try this?

| inputlookup abc.csv 
| chart sum(field1) as field1 by field2, field3 
| addtotals 
| eval field1 = tostring(field1, "commas") 

 

For further help can you please share sample output of below search?

| inputlookup abc.csv 
| chart sum(field1) as field1 by field2, field3 
| addtotals 
 

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote  If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...