Using eval to generate a dollar value and 2 decimals

[apalen]

Hey Splunkers,

I am attempting to run a search to generate a dollar value my current search is:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "getSettle(?:Now|ment)Total.+?(?\d+)" | top 50 settlement | stats first(settlement)

This search produce the most recent transaction to happen. The data is currently displayed as just a number value without the decimals. If you look below results like 3500 should actually be $35.00

My question is how can i get splunk to insert both the decimal and the dollar?

Below is a broad search using:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "getSettle(?:Now|ment)Total.+?(?\d+)" | search settlement="*"

1 35:40.7 log4j 3500

2 35:40.6 log4j 0

3 35:40.6 log4j 3500

4 35:40.4 log4j 3500

5 35:40.4 log4j 3500

6 35:40.3 log4j 3500

7 35:40.3 log4j 3500

8 35:40.3 log4j 3500

9 35:40.3 log4j 3500

10 35:40.3 log4j 3500

any information will be helpful, thanks in advance splunkers!

[alterdego]

Try using the tostring function with EVAL.

Not quite what you are looking to do, but perhaps informative:
http://answers.splunk.com/answers/11399/rounding-currency-to-two-digits-after-decimal

EVAL Functions:
http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/CommonEvalFunctions

[devicenul1]

Just a warning ... if your totaling these numbers (something like | addtotals row=f col=t column1 column2 column3 ) make sure you do the totals before you do the evals as changing the numbers to strings and formatting them with commas will exclude them from your total columns. Eval Column=tostring will also cause value to be left aligned as it's now a string and no longer a number in PDF exports.

[martin_mueller · Accepted solution]

Add this to the end:

... | eval settlement = "$" . (settlement / 100)

That should display 3500 as "$35", and 3501 as "$35.01". Do you need the ".00" added as well?

[martin_mueller]

Great - don't forget to mark this as solved.

[apalen]

no, the .00 is not needed, this is what i needed! Thanks Martin!!! i have been banging my head on this for longer then i care to admit!

[apalen]

Side note: this doesn't have to be done with eval, just from what i read, eval is the way i want to go. If anyone has a better suggestion please don't hesitate!
I have also used fieldformat, it will make it a dollar value, but i cant find a way to insert the decimal.