This could be also solution for you. https://community.splunk.com/t5/Splunk-Search/FileSize-to-human-readable/m-p/629602/highlight/true#M218718 | makeresults count=35 ```THIS SECTION IS JUST CREATING SAMPLE VALUES.``` | streamstats count as digit | eval val=pow(10,digit-1), val=val+random()%val | foreach bytes [eval <<FIELD>>=val] | table digit val bytes | fieldformat val=tostring(val,"commas") ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB")) If you can install app or ask admin on your to install app, installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2). Example | makeresults count=35 ```THIS SECTION IS JUST CREATING SAMPLE VALUES.``` | streamstats count as digit | eval val=pow(10,digit-1), val=val+random()%val | foreach bytes [eval <<FIELD>>=val] | table digit val bytes | fieldformat val=tostring(val,"commas") ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`) Numeral system macros for Splunk https://splunkbase.splunk.com/app/6595 Usage: How to convert a large number to string with expressions of long and short scales, or neither. https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressions-of-long/m-p/629383
... View more
