how to place commas in the output of a chart with columns that varies depending on the search

[jonathan_yan5]

how to place commas in the output of a chart with columns that varies depending on the search (example is date). Sample search would be index=indexname | chart count(fieldname) over xfieldname by date_mday. Results are numerals which i intend to place commas as a thousands separator but was unable to do so because i do not know how would i command a tostring to a variable column name. please help.

[woodcock · Accepted solution]

First of all, DO NOT use the "free" (but always wrong) date_* fields, calculate your own like this

... | eval date_mday = strftime(_time, "%d")

As far as commas, do this:

...| foreach * [ eval <<FIELD>>= if(isnum($<<FIELD>>$), tostring($<<FIELD>>$, "commas"), $<<FIELD>>$) ]

[jonathan_yan5]

did not seem to get the solution applying the above formula. here is my search:

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") | chart eval(round(count(PRODUCT)2.5,2)) over TYPE by YMD useother=f limit=500 | addtotals col=true 2016- labelfield=TYPE label="Product Type Totals" fieldname="Totals"

i need to place commas on all numeric values inside columns and totals

[jonathan_yan5]

to add, the sum of "tostring" values when adding commas are not reflected on totals

[woodcock]

I just tried it (again) and it worked perfectly. Try this:

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") 
| chart eval(round(count(PRODUCT)*2.5,2)) over TYPE by YMD useother=f limit=500
| addtotals col=true 2016-* labelfield=TYPE label="Product Type Totals" fieldname="Totals"
| foreach * [ eval <<FIELD>>= if(isnum($<<FIELD>>$), tostring($<<FIELD>>$, "commas"), $<<FIELD>>$) ]

[jonathan_yan5]

thanks woodcock it worked using manual search.
one problem though, on my dashboard, i have a timerange ticker. the search we have (with dollar sign) does not load on a time range ticker dashboard. maybe the value of the time range ticker is being replaced on our search with dollar signs?

the panel is showing "search is waiting for input..."

[woodcock]

Escape the dollar-signs by adding a second one next to each.

[jonathan_yan5]

Wow! thanks a lot, it worked!

[sundareshr]

Try this

... | foreach * [eval <<FIELD>>=if("<<FIELD>>" == "date_mday", <<FIELD>>, tostring(round('<<FIELD>>', 2), "commas")))]

[jonathan_yan5]

did not seem to get the solution applying the above formula. here is my search:

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") | chart eval(round(count(PRODUCT)2.5,2)) over TYPE by YMD useother=f limit=500 | addtotals col=true 2016- labelfield=TYPE label="Product Type Totals" fieldname="Totals"

i need to place commas on all numeric values inside columns and totals

[jonathan_yan5]

to add, the sum of "tostring" values when adding commas are not reflected on totals

[sundareshr]

Try this

index=indexname | eval YMD=strftime(_time,"%Y-%m-%d") | chart sum(eval(round((PRODUCT*2.5),2))) over TYPE by YMD useother=f limit=500 | addtotals col=true 2016- labelfield=TYPE label="Product Type Totals" fieldname="Totals" |  foreach * [eval <<FIELD>>=if("<<FIELD>>" == "YMD", <<FIELD>>, tostring('<<FIELD>>', "commas")))]

[jonathan_yan5]

hi sundareshr thanks for your effort. however using your search does not show the "TYPE" column on the output.