Hi,
As far as i know Splunk does not have inbuilt functionality to convert/format number in 10000 as 10K or 1000000 as 1M. So i wrote few eval statements which does the task and i am able to get the result as required.
![alt text][1]
In the Image above, i have sorted the 2nd column (**Val1**) and then converted into K's & M's format and it pretty well serves the purpose.
But the issue is, unlike as in the image above i have many columns Val2, Val3..... Val11, with so many rows and whenever i click on the header (Val2, Val3.. or so on) to sort the sort happens on the basis of String. Like if click on **Val3** header the sorting will happen like **K** first then **M** and then the **number** or the **number**, then **M** and then **K**
Is there a way/feature by which the sorting happens in a custom or user defined way where in the way in the search query i have sorted before converting into K & M format, i could do so when clicking on the table headers.
[1]: /storage/temp/158224-image.png
↧