Splunk Search

Table showing highest usage by host where usage is comma separated

jeck11
Path Finder

Here is the search I'm using:

index="_internal" source="*metrics.log" per_host_thruput series NOT splunk |  eval kb = round(kb,0) | stats sum(kb) by series | sort sum(kb) desc | rex field=series "(?<series>.*).domain"

I'd like the column labeled sum(kb) to be comma separated, but the couple ways I've tried will not work because it's viewed as summing.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

index="_internal" source="*metrics.log" per_host_thruput series NOT splunk | eval kb = round(kb,0) | stats sum(kb) as kbSum by series | sort kbSum desc | fieldformat kbSum=tostring(kbSum, "commas") | rex field=series "(?<series>.*).domain"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this:

index="_internal" source="*metrics.log" per_host_thruput series NOT splunk | eval kb = round(kb,0) | stats sum(kb) as kbSum by series | sort kbSum desc | fieldformat kbSum=tostring(kbSum, "commas") | rex field=series "(?<series>.*).domain"
---
If this reply helps you, Karma would be appreciated.

jeck11
Path Finder

Thank you Rich! That worked perfectly.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're welcome. Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...