topic Re: How to roundoff the results to 2 decimal degits in Dashboards & Visualizations

How to roundoff the results to 2 decimal digits?

SG — Wed, 23 Mar 2022 22:54:01 GMT

HI,

I have a search query as below

index= **** | stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service

It gives me results as below...

i wanted to roundoff the decimal values to 2 digits for all column values. I tried something like this but it didnt give me any results, Can you please help me how can i trim the results to 2 digits.

index= **** | eval upstream_response_times = round(upstream_response_time,2) | stats avg(upstream_response_times), p95(upstream_response_times), p99(upstream_response_times) by service

Re: How to roundoff the results to 2 decimal degits

ITWhisperer — Fri, 18 Mar 2022 11:06:28 GMT

index= **** | stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service | foreach *upstream_response_time* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]

Re: How to roundoff the results to 2 decimal degits

SG — Fri, 18 Mar 2022 11:30:11 GMT

Tried the below ways, but the result is not trimmed to 2 digits

index= **** | stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service | foreach "upstream_response_time" [| eval "upstream_response_time"=round('upstream_response_time',2)] index= **** | stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service | foreach *upstream_response_time* [| eval "upstream_response_time"=round('upstream_response_time',2)]

Re: How to roundoff the results to 2 decimal degits

PickleRick — Fri, 18 Mar 2022 11:46:05 GMT

'<<FIELD>>' was not used here by @ITWhisperer as a string to replace by you. It should have been pasted as is. It's a placeholder to be replaced during the search by the field name matched by foreach.

See https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Foreach

You might consider using fieldformat instead of eval but that can lead to some hard to spot inconsistencies if you plan to further process the fields down the pipeline.

Re: How to roundoff the results to 2 decimal digits

SG — Mon, 21 Mar 2022 03:38:34 GMT

Even as is if i mention the field name also it is not rounding off the results.

Re: How to roundoff the results to 2 decimal digits

bowesmana — Mon, 21 Mar 2022 04:05:47 GMT

In the eval statement, put the word

<<FIELD>>

as directed by @ITWhisperer and NOT what you have put.

Re: How to roundoff the results to 2 decimal digits

SG — Mon, 21 Mar 2022 04:40:41 GMT

Even that is not helping me to roundoff the column values.

I wanted to mention one more thing here, i.e, the values i am planning to search here are written to summary index from the original index.

Thanks,

Re: How to roundoff the results to 2 decimal digits

PickleRick — Mon, 21 Mar 2022 18:37:59 GMT

This time you omitted the asterisks around the partial field name.

Please see https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Foreach for the description how foreach works.

Re: How to roundoff the results to 2 decimal digits

ITWhisperer — Mon, 21 Mar 2022 07:49:17 GMT

Try doing the foreach exactly as I suggested

Re: How to roundoff the results to 2 decimal degits

SG — Mon, 21 Mar 2022 08:27:37 GMT

Thank a lot, Its working.

Re: How to roundoff the results to 2 decimal digits

SG — Wed, 23 Mar 2022 06:06:13 GMT

HI,

I applied the same and it is working fine. Thanks!!!