Splunk Search

How to edit my search to add commas to the numbers and rename the row names?

elijahputnam
New Member

Hello,

I have two questions.

1) In my search below, I am trying to add Commas to the numbers, but the Totals field disappears when the search is using commas. When I remove stats count by action | eval count = tostring(count, "commas"), everything shows up as expected, but without the commas.

index=pan_logs  sourcetype=pan:threat  log_subtype!=url action=allowed OR action=blocked severity!=informational severity!=low| stats count by action | eval count = tostring(count, "commas") | fields action count | rename action AS "Action", count as "Attempts" | addcoltotals|fillnull value="Total""

2) I would like to rename the row names. As you can see, I have already successfully renamed the columns, but I want to capitalize the rows as well.

Thank you

Tags (4)
0 Karma

woodcock
Esteemed Legend

The problem is that once you convert "count" from an integer to a "string", any "adding" function can no longer work. So move the tostring to the end like this:

index=pan_logs  sourcetype=pan:threat  log_subtype!=url action=allowed OR action=blocked severity!=informational severity!=low
| stats count AS Attempts BY action
| addcoltotals
| fillnull value="Total""
| eval count = tostring(Attempts, "commas")
| rename action AS "Action"
0 Karma

sundareshr
Legend

Try this

 index=pan_logs  sourcetype=pan:threat  log_subtype!=url action=allowed OR action=blocked severity!=informational severity!=low | stats count by action | fields action count | rename action AS "Action", count as "Attempts" | addcoltotals|fillnull value="Total"  | eval Action=upper(Action) | eval count = tostring(count, "commas") 
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...