Splunk Search

How to keep the number on the right side after changing the commas with space to match canadian number format?

usernamejpblais
Engager

Hello Splunker!

I added the "tostring + commas" to a number to get the thousand separator. Work's fine.

The problem is when I do the rex command to replace the commas with a space to match the canadian format number, my numbers get shifted on the left side. Is there another way to do so, so I can keep my number on the right side? See code below:

| eval sum_totrows=tostring(sum_totalrows,"commas")
| rex field=sum_totrows mode=sed "s/,/ /g"

Result:
407 930
119
14 131
...

Thanks!

0 Karma

to4kawa
Ultra Champion

Canadian style
that's interesting

| eval sum_totrows=replace(tostring(sum_totalrows,"commas"),","," ")
one liner.

0 Karma

usernamejpblais
Engager

I like that one liner but I have the same problem, number shift to the left.

0 Karma

to4kawa
Ultra Champion

That's exactly what @richgalloway says.
Creating dashboard can use js and css, maybe we can.
but I don't know. ask another experts.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is justification setting in Splunk. Numbers are automatically right-justified and strings are left-justified (at least in the US locale). Putting spaces in numbers converts them to strings so that is why they are left-justified.

---
If this reply helps you, Karma would be appreciated.
0 Karma

usernamejpblais
Engager

Ok I understand, so is there a way to configure the setting to change the thousand separator from commas to space?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I am not aware of one.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...