- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Adding commas to "stats sum"
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'm trying to add commas to the TotalPrints field as shown in the code below. I have tried the fieldformat=stringto but it just creates an empty additional TotalPrints field. Can someone please advise?
Also a quick one, how can I make the TotalPrints in descending order and limit it top top 10? I have tried sort- and limite=10 but it doesnt appear to do anything..
source="PrinterDemo.csv"
| multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints
| stats sum(TotalPrints) by "Location"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks very much 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Alternatively, you could use | fieldformat sum(TotalPrints) = tostring('sum(TotalPrints)', "commas") but I prefer somesoni2's approach!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yup... at the end I've added
| fieldformat TotalPrints=tostring(TotalPrints,"commas")
and
|fieldformat "sum(TotalPrints)"=tostring(TotalPrints,"commas")
no joy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you show what your search string when you tried to use fieldformat looked like?
Join Us for Splunk University and Get Your Bootcamp Game On!
.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!
Announcing Scheduled Export GA for Dashboard Studio
