Splunk Search

PDF Export and Eval

devicenul1
Path Finder

6.1.1 known issues:
Events format settings like list, table, max lines, wrapping do not apply to PDF reports and are not used. (SPL-67491)

Were using Eval to do comma formatting on some fields:
eval Merch=tostring(Merch,"commas")

and noticed that in the generated pdf fields formatted with commas are not in line like they are with the dashboard. The other numbers are right aligned, they are left aligned

(dashboard)
|Merch |
| 1,260.00|

(exported pdf)
|Merch |
|1,260.00 |

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

After making is comma formatted, the PDF generator code treat that as 'Text' instead on 'Number'. All text are Left aligned, hence the issue.

View solution in original post

devicenul1
Path Finder

The above convert actually ended up being bad news bears for me. We had total columns and it was causing values with formatting to be excluded from the total. I had to go back to no CONVERT in the SQL but doing the |addtotals first then | eval Column=tostring(Column,"commas")

0 Karma

devicenul1
Path Finder

That makes complete sense ... if you come back and make an answer I'll mark it for you ^^. I worked around this by converting our columns in SQL, something like:

CONVERT(varchar(12), CONVERT(MONEY, table.column), 1) as MoneyColumn

0 Karma

somesoni2
Revered Legend

After making is comma formatted, the PDF generator code treat that as 'Text' instead on 'Number'. All text are Left aligned, hence the issue.

devicenul1
Path Finder

The space idea was a good work around, it still doesn't line up for me but it is a good thought. I know it's not excel but it kind of stinks you can't just pick a justification on a table (left or right) and it's applied to all data in the table.

0 Karma

somesoni2
Revered Legend

I have the same issue and I ended up adding a pipe character and 6 spaces before each value (after all the totalling). Not a good solution but it looks acceptable in the PDF/printed form.

all search with total | eval mytotal="| ".tostring(mytotal,"commas")

splunkn
Communicator

Hi. I have a similar issue like this. I want to extract the users list which contains ids (numbers) and names(text). As you discussed text are left aligned and numbers are right aligned. But i append space with that field. Still those are not changing. Could you please help?

search ... | eval Users = " " + username | table Users | sort Users

0 Karma

devicenul1
Path Finder

no one else having this problem?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...