More concise... Splunk is a tool that can analyze and visualize various types of data. The advantage of visualization is that you can understand what you could not understand before. By showing the visualized results to others, we can have a common understanding and collaborate with each other. I think this is one of the reasons why Splunk is a very useful tool. However, as you become more familiar with Splunk's Search Processing Language (SPL), it tends to become longer and more cluttered. Want to write SPL more concisely! Start by making the numbers manageable. Since Splunk can be described as a tool with a search function + analysis function, it handles various types of numbers depending on how the tool is used. This time, I’ve created a macro library for unit conversion from the point of view what can be done to handle these "various types of numbers" in a more concise manner. Area: How many square feet is a square meter (㎡) ? Length: How many centimeters is an inch? How many feet, how many yards? Volume: How many liters are in a gallon? Temperature: How many degrees Celsius (°C) in Fahrenheit (°F)? How many Kelvin (K)? Data transfer rate: How many byte/s is a Mbps? The following other units of measure are also supported for conversion. (Units in the same category can be converted to each other.) List of units that can be converted by macro category unit Area Acre[ac], Hectare[ha], Square foot[sq ft], Square inch[sq in], Square killometer[km2], Square meter[m2], Square mile[sq mi], Square yard[sq yd], Tatami mats[畳], Tsubo[坪] Data Transfer Rate Bit per second[bps], Byte per second[B/s], Gibibit per second[GiBit/s], Gigabit per second[Gbps], Gigabyte per second[GB/s], Kibibit per second[KiBit/s], Kibibyte per second[KiB/s], Kilobit per second[kbps], Kilobyte per second[KB/s], Mebibit per second[MiBit/s], Mebibyte per second[MiB/s], Megabit per second[Mbps], Megabyte per second[MB/s], Tebibit per second[TiBit/s], Tebibyte per second[TiB/s], Terabit per second[Tbps], Terabyte per second[TB/s] Digital Storage Bit[bit], Byte[bytes], Gibibit[GiBit], Gibibyte[GiB], Gigabit[Gbit], Gigabyte[GB], Kibibit[KiBit], Kibibyte[KiB], Kilobit[Kbit], Kilobyte[KB], Mebibit[MiBit], Mebibyte[MiB], Megabit[Mbit], Megabyte[MB], Pebibit[PiBit], Pebibyte[PiB], Petabit[Pbit], Petabyte[PB], Tebibit[TiBit], Tebibyte[TiB], Terabit[Tbit], Terabyte[TB] Energy British thermal unit[Btu], Electronvolt[eV], Foot-pound[ft lbf], Gram calorie[cal], Joule[J], Kilocalorie[kcal], Kilojoule[kJ], Kilowatt hour[kW-h], US therm[therm(US)], Watt hour[W-h] Frequency Gigahertz[GHz], Hertz[Hz], Kilohertz[kHz], Megahertz[MHz] Fuel Economy Kilometer per liter[km/L], Liter per 100 kilometers[l/100km], Miles per gallon (imperial)[mpg (Imp)], Miles per gallon[mpg (US)] Length Centimeter[cm], Foot[ft], Inch[in], Kilometer[km], Meter[m], Micrometer[μm], Mile[mi], Millimeter[mm], Nanometer[nm], Nautical mile[nmi], Yard[yd] Mass Gram[g], Imperial ton[long tn], Kilogram[kg], Metric ton[t], Microgram[μg], Milligram[mg], Ounce[oz av], Pound[lb av], Stone[st], US ton[sh tn] Plane Angle Arcsecond[″], Degree[°], Gradian[grad], Milliradian[μ], Minute of arc[′], Radian[rad] Pressure Bar[bar], Pascal[Pa], Pound-force per square inch[psi], Standard atmosphere[atm], Torr[Torr] Speed Foot per second[fps], Kilometer per hour[km/h], Knot[kn], Meter per second[m/s], Mille per hour[mph] Temperature Degree Celsius[°C], Fahrenheit[°F], Kelvin[K] Time Calender year[y], Century[C], Day[d], Decade[decade], Hour[h], Microsecond[μs], Millisecond[ms], Minute[min], Month[mo], Nanosecond[ns], Second[s], Week[wk] Volume Cubic foot[cu ft], Cubic inch[cu in], Cubic meter[m3], Imperial cup[c (Imp)], Imperial fluid ounce[fl oz (Imp)], Imperial gallon[gal (Imp)], Imperial pint[pt (Imp)], Imperial quart[qt (Imp)], Imperial tablespoon[tbsp (Imp)], Imperial teaspoon[tsp (Imp)], Liter[l], Milliliter[ml], US fluid ounce[US fl oz], US legal cup[c (US)], US liquid gallon[gal (US)], US liquid pint[pt (US fl)], US liquid quart[qt (US)], US tablespoon[tbsp (US)], US teaspoon[tsp (US)]   A bit useful dashboard where you can find macros and learn how to use them It can also be used as a quick reference table for unit conversions. Conversion of units   Drill down (click on the table) to open a sample SPL in a search. Usage example Legend of macro usage | eval FieldAfterConversion = `numeral_UnitBefore_to_UnitAfter(FieldBeforeConversion)`   There is also a dashboard for checking how to use macros that display large numbers with expression such as "150 million", and macros that convert the number of bytes into human easy readable units. large numbers to human readable   When you finish researching and decide that you don't need the UI screen anymore, you can hide the UI and continue using only the macros. Steps to hide apps: "Manage App" → "Edit Properties" of Numeral system macros for Splunk → Visible: Check "No" → "Save"   Let's give it a try! Numeral system macros for Splunk https://splunkbase.splunk.com/app/6595 (Please rate this app ★★★★★!)  ... View more

Numeral system macros for Splunk v1.1.1 Bytes to printing Human readable size (e.g. 4KiB, 1023.4MiB, 23.4GiB, 345,67TiB) Sometimes it is necessary to divide Bytes by powers of 1024 and convert it to human readable units. In that case, it would not look good if you write that calculation in the SPL each time and the SPL becomes long, so I think it would be good if we could use a common macro to make it simple. For this purpose, I added 2 macros to Numeral system macros for Splunk v1.1.1. numeral_binary_symbol(bytes) Binary symbol. KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB, RiB, QiB numeral_binary_symbol(bytes,digits) Binary symbol with arg for rounding digits. For other macros provided, click here Usage1 | makeresults count=35 ```THIS SECTION IS JUST CREATING SAMPLE VALUES.``` | streamstats count as digit | eval val=pow(10,digit-1), val=val+random()%val | foreach bytes [eval <<FIELD>>=val] | table digit val bytes | fieldformat val=tostring(val,"commas") ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 9s",`numeral_binary_symbol(bytes,1)`)   Usage2 Example of sorting sourcetypes in descending order of throughput. index="_internal" source="*metrics.log" per_sourcetype_thruput | stats sum(eval(kb*1024)) AS bytes by series ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`) | sort 0 - bytes Points :  The internal value is still in Byte. Sortable. The kb information can be converted to bytes and a common macro can be used. Since the fieldformat retains the original value internally, the MiB and KiB displays can also be used for sorting, with the values being comparable. Why weird units KiB, MiB using instead of KB, MB? As a side note, in the general public, the definition of “kilo” is 1000 and has no other meaning, but in the computer world, it has long been a common belief that KB (Killo Byte) is 1024 bytes to the 10th power of 2, as if it were common knowledge in the industry. However, this is definitely a source of confusion, so standards such as IEC 60027-2, IEEE 1541-2002, and IEC 80000-13:2008 defines the KiB (Kibibyte) and MiB (Mebibyte) units as byte units based on 1024 bytes to avoid confusion. These units are not at all widespread and unfamiliar to us, but since confusion over numbers is a source of misunderstanding, I dared to use these units in that macros in order to avoid misunderstanding and to have a common understanding in Splunk’s output. Enjoy Splunking!     ... View more

Numeral system macros for Splunk Examples of Single Value panel and Table. Hello, Just an announcement. I have created macros that converts a number into a string with a language specific expressing (long and short scales, or neither). It was released on splunkbase. https://splunkbase.splunk.com/app/6595 Language-specific expressions may be useful when displaying huge numbers on a dashboard to make their size easier to understand. Or it may help us to mutually understand how numbers are expressed in other languages. Ref.: About long and short scales (numeration system). https://en.wikipedia.org/wiki/Long_and_short_scales Example of Use: Sample for English speakers | makeresults | eval val=1234567890123, val=`numeral_en(val)` | table val 1 trillion 234 billion 567 million 890 thousand 123 Provided macros: numeral_en(1) : Short Scale for English speaker numeral_metric_prefix(1) : Metric prefix. kilo, mega, giga, tera, peta, exa, zetta, yotta numeral_metric_symbol(1) : Metric symbol. K, M, G, T, P, E, Z, Y numeral_jp(1) : 万進法 for Japanese speaker. 千, 万, 億, 兆 numeral_kr(1) : for Korean speaker. 千, 萬, 億, 兆 numeral_cn_t(1) : Chinese with Traditional Chinese characters. 千, 萬, 億, 兆 numeral_cn(1) : Chinese with Simplified Chinese characters. 千, 万, 亿, 兆 numeral_in_en(1) : for India, South Asia English. thousand, lakh, crore, lakh crore numeral_in_en2(1) : for India, South Asia English. thousand, lakh, crore, arab numeral_nl(1) : Long Scale for Nederland. duizend, miljoen, miljard, biljoen numeral_fr(1) : Long Scale for French. mille, million, milliard, billion numeral_es(1) : Long Scale for Spanish speaker. mil, millón, millardo, billón numeral_pt(1) : Long Scale for Portuguese speaker. mil, milhão, bilhão, trilhão Followings also provided since v1.1.1 numeral_binary_symbol(1) : Binary symbol. KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB, RiB, QiB numeral_binary_symbol(2) : Binary symbol with arg for rounding digits.     See Next article "How to convert large bytes to human readable units (e.g. Kib, MiB, GiB)" More details See Details tab on https://splunkbase.splunk.com/app/6595 Install this add-on into your search heads. Advanced examples Sample usage for using all provided macros. With rounding lowest 3 digit if over 6 digit. | makeresults count=35 | streamstats count as digit | eval val=pow(10,digit-1), val=val+random()%val.".".printf("%02d",random()%100) | foreach metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr [eval <<FIELD>>=val] | table digit val metric_prefix metric_symbol binary_symbol en es pt in_en in_en2 jp kr cn_t cn nl fr | fieldformat val=tostring(val,"commas") | fieldformat metric_prefix=`numeral_metric_prefix(if(log(metric_prefix,10)>6,round(metric_prefix,-3),metric_prefix))` | fieldformat metric_symbol=`numeral_metric_symbol(if(log(metric_symbol,10)>6,round(metric_symbol,-3),metric_symbol))` | fieldformat binary_symbol=printf("% 10s",`numeral_binary_symbol(binary_symbol,2)`) | fieldformat en=`numeral_en(if(log(en,10)>6,round(en,-3),en))` | fieldformat es=`numeral_es(if(log(es,10)>6,round(es,-3),es))` | fieldformat pt=`numeral_pt(if(log(pt,10)>6,round(pt,-3),pt))` | fieldformat in_en=`numeral_in_en(if(log(in_en,10)>6,round(in_en,-3),in_en))` | fieldformat in_en2=`numeral_in_en2(if(log(in_en2,10)>6,round(in_en2,-3),in_en2))` | fieldformat jp=`numeral_jp(if(log(jp,10)>6,round(jp,-3),jp))` | fieldformat kr=`numeral_kr(if(log(kr,10)>6,round(kr,-3),kr))` | fieldformat cn_t=`numeral_cn_t(if(log(cn_t,10)>6,round(cn_t,-3),cn_t))` | fieldformat cn=`numeral_cn(if(log(cn,10)>6,round(cn,-3),cn))` | fieldformat nl=`numeral_nl(if(log(nl,10)>6,round(nl,-3),nl))` | fieldformat fr=`numeral_fr(if(log(fr,10)>6,round(fr,-3),fr))` The results of this search will look like the table in the top image of this article. ... View more