About mjosen

lguinn2 · ‎03-21-2017

In Splunk 6.5, you can format a table column in a dashboard. You can apply both numeric and color formatting. This is preferable to using the fieldformat command. fieldformat never worked consistently (when combined with other commands) to display a formatted numeric value while preserving the underlying field as numeric. Here is the documentation showing how to Format table visualizations.

martin_mueller · ‎03-13-2014

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search: index=_internal `commasToOr("error,warn")` using this eval-based macro definition: [commasToOr(1)] args = token definition = replace("$token$", ",", " OR ") iseval = 1 Looking at the job inspector, the search that was actually executed is this: search index=_internal error OR warn You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

HattrickNZ · ‎05-18-2015

90 worked for me in version 6.1

Posts	3
Solutions	0
Karma Given	4
Karma Received	7
Member Since	‎11-12-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Keep numbers right-aligned after using fieldformat

Manipulate a Token String in a Form

Vertical x-axis labels in Splunk 6

Re: Keep numbers right-aligned after using fieldfo...

Re: Manipulate a Token String in a Form

Re: Vertical x-axis labels in Splunk 6

Are you a member of the Splunk Community?