Splunk Search

Replace comma with the dot

lrudolph
Path Finder

Hi,

I have evaluated a field count with value 10000. Then I converted it with fieldformat to include a thousand separator to display it on a single value panel. Now I want to replace the comma with a dot, because we are in Europe. How can I do that?

I already tried this:

searchstring | stats count |
fieldformat count=tostring(count,
"commas") | rex field=count mode=sed
"s/\,/./g"

The result makes no difference - it's still as if I didn't use the rex-command.

Thanks,

Leo

Tags (1)
1 Solution

sowings
Splunk Employee
Splunk Employee

I agree that fieldformat doesn't seem to play nice. I wonder if its execution is "delayed" in that the formatting rules it dictates are only applied late (at display level). In any event, I was able to get the desired effect with this:

searchstring | stats count | eval count=tostring(count, "commas") | rex field=count mode=sed "s/,/./g"

The other answers post quoted by @lukejadamec says that commas should be locale-specific, but my own experimentation suggests that it is not. I've filed a case.

View solution in original post

sowings
Splunk Employee
Splunk Employee

I agree that fieldformat doesn't seem to play nice. I wonder if its execution is "delayed" in that the formatting rules it dictates are only applied late (at display level). In any event, I was able to get the desired effect with this:

searchstring | stats count | eval count=tostring(count, "commas") | rex field=count mode=sed "s/,/./g"

The other answers post quoted by @lukejadamec says that commas should be locale-specific, but my own experimentation suggests that it is not. I've filed a case.

lrudolph
Path Finder

Perfect! This does the trick!

0 Karma

lukejadamec
Super Champion

An older post suggests that the "commas" operator is locale specific, i.e. it should use decimals for Europe...
http://answers.splunk.com/answers/41636/tostring-commas-and-locale-specific-separators

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...