• Todd Waller

Splunk - Quick Tip: Formatting currency

Hello Everyone! This weeks post is a quick tip on formatting currency. Splunk doesn't auto-format so sometimes figuring out how to format currency can be tricky so here's the quick tip!

So say you have a data set that looks like this for example:

What you could do is add an eval statement like this to format the field containing the data you want to be formatted as currency:

And then run the search again and get data formatted:

Hopefully this quick tip helps you to achieve your desired results. Talk to you all again soon and have a great weekend!!

32 views0 comments

Recent Posts

See All

Do you need to dedup when using stats?

I had to do some casual counting of sourcetypes today. In the process I was trying to decide if I needed to dedup before going to stats. It seemed to me a dedup would, in theory, pass less data to sta

How do I learn Splunk administration?

Had an old coworker hit me up a week ago. He took a job as a SOC analyst where part of his job is going to be supporting Splunk. He's a smart guy but Splunk is more complex than it looks. Given I've a