How do you convert thousands to K in a column chart?

[sprayer122]

Hi everyone,

I'm trying to make a column chart where I want to display the values with the K notation when the number is greater than 1000 please.

Basically, I have a query that returns a table with two columns : month and number of events.
I've figured out how to create a column with the K notation by doing this :

... | timechart span=1mon count |  eval k = round(count/1000, 1) | eval k_final = tostring(k)."K" | rename k_final as "Dossiers terminés" | fields - _span k k_final | table mois_fr "Dossiers terminés" k_final

The problem is that it is not possible to create a chart from string values...

Has anybody got a solution please ?

Thanks in advance

[niketn]

@sprayer122 if you are on Splunk 7.0.0 or higher you can use Simple XML Chart configuration reference to convert axis labels to actual to abbreviations using K format.

charting.axisX.abbreviation : (none | auto) 
charting.axisY.abbreviation
charting.axisY2.abbreviation    

For example:

 <option name="charting.axisY.abbreviation">auto</option>

PS: Enables the abbreviations of large X, Y, and Y2 numerical values with the closest SI prefix, default value is none
charting.axisY2.abbreviation is not supported for scatter and bubble charts.

[richgalloway · Accepted solution]

The solution is to remove the "K" from the field. Add "(K)" to the axis label of your chart so users understand numbers are in thousands.

As an aside, there is no need to include k_final in the fields command as that field no longer exists because it was renamed. For the same reason, you also can remove 'k_final' from the table command.