| fieldformat totalSales="$".tostring(totalSales,"commas") Extended example 1. Use a period character as a binary concatenation operator, followed by the tostring function, which enables you to display commas in the currency values. To format numerical values in a field with a currency symbol, you must specify the symbol as a literal and enclose it in quotation marks. | fieldformat start_time = strftime(start_time, "%H:%M:%S") 3. Format the start_time field to display only the hours, minutes, and seconds that correspond to the UNIX time. Display UNIX time in a readable formatĪssume that the start_time field contains UNIX time. | fieldformat totalCount=tostring(totalCount, "commas")Ģ. The values in the totalCount field are formatted to display the values with commas. Use the fieldformat command to reformat the appearance of the field values. The results appear on the Statistics tab and look something like this: The table command is used to return only the sourcetype and totalCount fields. The metadata command returns many fields. This example uses the metadata command to return results for the sourcetypes in the main index. Use the links in the table to learn more about each function, and to see examples.īasic examples 1. The following table lists the supported functions by type of function. For general information about using functions, see Evaluation functions. You can use a wide range of functions with the fieldformat command. Time format variables are frequently used with the fieldformat command. The fieldformat command is a distributable streaming command. See Examples.įor more information, see the eval command.įor information about supported functions, see Usage. To specify multiple formats you must use multiple fieldformat commands. You can specify only one with the fieldformat command. Syntax: Description: A combination of values, variables, operators, and functions that represent the value of your destination field. Required arguments Description: The name of a new or existing field, non-wildcarded, for the output of the eval expression. If you want the format to apply to exported data, use the eval command instead of the fieldformat command. The export retains the original data format and not the rendered format. The fieldformat command does not apply to commands that export data, such as the outputcsv and outputlookup commands. This command changes the appearance of the results without changing the underlying value of the field.īecause commands that come later in the search pipeline cannot modify the formatted results, use the fieldformat command as late in the search pipeline as possible. With the fieldformat command you can use an to change the format of a field value when the results render.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |