Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- tostring commas and locale specific separators
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
tostring commas and locale specific separators
My question is whether or not the tostring command is locale specific. If the locale specifies commas as the decimal and periods as the separator will tostring do the the right thing?
It might better if the option was tostring(
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where can I configure "commas" as "locale specific" ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My browser settings ? Just checked on both Safari (Mac OS X) and Chrome and nothing like that it's there ...
Any pointers ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's based on your browser settings.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it might be better. But the "commas" operator is locale specific.
[Update] I am wrong. After believing this for a long time, I was chagrined to find that it is untrue. The commas operator of the tostring command inserts commas. Always.
@sowings has a solution:
searchstring
| stats count
| eval count=tostring(count,"commas:)
| rex field=count mode=sed "s/,/./g"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually that isn't complete. This would show 1234.56 as 1.234.56 when it is expected to see 1.234,56
Add an extra 2 lines to fix it.
| eval count=tostring(count,"commas")
| rex field=count mode=sed "s/\./#/g"
| rex field=count mode=sed "s/,/./g"
| rex field=count mode=sed "s/#/,/g"
make it into a macro if you need it a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And my apologies for not coming back to this answer and fixing it sooner.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does not seem to be in my Swiss German settings
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So the "commas" operator will do the right thing?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
