Replace comma with the dot

[lrudolph]

Hi,

I have evaluated a field count with value 10000. Then I converted it with fieldformat to include a thousand separator to display it on a single value panel. Now I want to replace the comma with a dot, because we are in Europe. How can I do that?

I already tried this:

searchstring | stats count |
fieldformat count=tostring(count,
"commas") | rex field=count mode=sed
"s/\,/./g"

The result makes no difference - it's still as if I didn't use the rex-command.

Thanks,

Leo

[sowings · Accepted solution]

I agree that fieldformat doesn't seem to play nice. I wonder if its execution is "delayed" in that the formatting rules it dictates are only applied late (at display level). In any event, I was able to get the desired effect with this:

searchstring | stats count | eval count=tostring(count, "commas") | rex field=count mode=sed "s/,/./g"

The other answers post quoted by @lukejadamec says that commas should be locale-specific, but my own experimentation suggests that it is not. I've filed a case.

[lrudolph]

Perfect! This does the trick!

[lukejadamec]

An older post suggests that the "commas" operator is locale specific, i.e. it should use decimals for Europe...
http://answers.splunk.com/answers/41636/tostring-commas-and-locale-specific-separators