Splunk Search

How to display comma-delimited numbers in a timechart sum

wrangler2x
Motivator

I have this search

| tstats count AS myCount WHERE index=* by index, _time 
| where _time > relative_time(now(), "-1mon@mon") AND _time < relative_time(now(), "@mon") 
| timechart span=1mon sum(myCount) by index

which returns one column for each index, with the heading being the indexes name, and the content under that the sum of events for that index in the specified time-frame.

How can I get this sum to display with commas? (like 158,313,959 instead of 158313959.)

0 Karma
1 Solution

rjthibod
Champion

To answer your question, use the following

| timechart span=1mon eval(tostring(sum(myCount), "commas")) by index

Another recommendation, remove your second line and put the time bounds in the first part of the query

| tstats count AS myCount WHERE index=* earliest=-1mon@mon latest=@mon by index, _time
| timechart span=1mon eval(tostring(sum(myCount), "commas")) by index

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Just add following foreach command to your search

...your current search.. | foreach * [eval "<<FIELD>>"=tostring('<<FIELD>>',"commas") ]

rjthibod
Champion

To answer your question, use the following

| timechart span=1mon eval(tostring(sum(myCount), "commas")) by index

Another recommendation, remove your second line and put the time bounds in the first part of the query

| tstats count AS myCount WHERE index=* earliest=-1mon@mon latest=@mon by index, _time
| timechart span=1mon eval(tostring(sum(myCount), "commas")) by index

wrangler2x
Motivator

Adding the eval to the timechart was something I had already tried. Does not work.

0 Karma

wrangler2x
Motivator

Okay, I tried this again because of your comment and it does work. Last time I tried it I got no results found. I'm thinking I must have had the time picker on some weird setting. So I'm using this now, including the recommendation. Thanks.

0 Karma

rjthibod
Champion

Thank you for reconsidering.

0 Karma

rjthibod
Champion

I am confused because I get the result you requested if I copy and paste the query I posted. In general, one should avoid foreach as much as possible.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...