All Apps and Add-ons

Using eval to generate a dollar value and 2 decimals

apalen
Path Finder

Hey Splunkers,

I am attempting to run a search to generate a dollar value my current search is:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "getSettle(?:Now|ment)Total.+?(?\d+)" | top 50 settlement | stats first(settlement)

This search produce the most recent transaction to happen. The data is currently displayed as just a number value without the decimals. If you look below results like 3500 should actually be $35.00

My question is how can i get splunk to insert both the decimal and the dollar?

Below is a broad search using:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "getSettle(?:Now|ment)Total.+?(?\d+)" | search settlement="*"

1 35:40.7 log4j 3500

2 35:40.6 log4j 0

3 35:40.6 log4j 3500

4 35:40.4 log4j 3500

5 35:40.4 log4j 3500

6 35:40.3 log4j 3500

7 35:40.3 log4j 3500

8 35:40.3 log4j 3500

9 35:40.3 log4j 3500

10 35:40.3 log4j 3500

any information will be helpful, thanks in advance splunkers!

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Add this to the end:

... | eval settlement = "$" . (settlement / 100)

That should display 3500 as "$35", and 3501 as "$35.01". Do you need the ".00" added as well?

View solution in original post

alterdego
Path Finder

Try using the tostring function with EVAL.

Not quite what you are looking to do, but perhaps informative:
http://answers.splunk.com/answers/11399/rounding-currency-to-two-digits-after-decimal

EVAL Functions:
http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/CommonEvalFunctions

0 Karma

devicenul1
Path Finder

Just a warning ... if your totaling these numbers (something like | addtotals row=f col=t column1 column2 column3 ) make sure you do the totals before you do the evals as changing the numbers to strings and formatting them with commas will exclude them from your total columns. Eval Column=tostring will also cause value to be left aligned as it's now a string and no longer a number in PDF exports.

martin_mueller
SplunkTrust
SplunkTrust

Add this to the end:

... | eval settlement = "$" . (settlement / 100)

That should display 3500 as "$35", and 3501 as "$35.01". Do you need the ".00" added as well?

martin_mueller
SplunkTrust
SplunkTrust

Great - don't forget to mark this as solved.

0 Karma

apalen
Path Finder

no, the .00 is not needed, this is what i needed! Thanks Martin!!! i have been banging my head on this for longer then i care to admit!

apalen
Path Finder

Side note: this doesn't have to be done with eval, just from what i read, eval is the way i want to go. If anyone has a better suggestion please don't hesitate!
I have also used fieldformat, it will make it a dollar value, but i cant find a way to insert the decimal.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...