0

I have a column in splunk that I want to use to show totals. I would like for the dollar sign ($) to appear before the numbers in the totals column.

Here's my query:

index=prd_aws_billing (source="/*2017-12.csv") LinkedAccountId="123456678" ProductName="Amazon Elastic Compute Cloud" | stats sum(UnBlendedCost) AS Cost by ResourceId,UsageType,user_Name,user_Engagement

How do I get the numbers in the UnBlendedCost column to appear with a dollar sign in front of them?

bluethundr
  • 1,005
  • 17
  • 68
  • 141

1 Answers1

0

Here you changed the field from "unBlendedCost" to "sum(unBlendedCost)", so you should add an alias such as sum(unBlendedCost) AS unBlendedCost and it should work.

skoelpin
  • 212
  • 1
  • 5
  • What I'm trying to do is to get a $ sign to appear before the numbers in the UnBlendedCost column. Sorry if I didn't explain that well. How can I do that? – bluethundr Mar 07 '18 at 23:23
  • You need to turn the number to a string then concatenate the $ symbol on it like this `| fieldformat cost="$".tostring(Cost)` – skoelpin Mar 09 '18 at 14:46