topic Re: problem with rounding bytes to gb in Splunk Search

problem with rounding bytes to gb

net1993 — Mon, 08 Jun 2020 22:01:32 GMT

Hello
I have use this command to convert from bytes to GB:
| eval b = b /1024/1024/1024
and this is an example value as result:
index1: 0.00000872090458869934
but the value is to long so I tried to round using this instead:
| foreach * [ eval <>=round('<>'/1024/1024/1024, 3)]
but then I get this result:
index1: 0.000
and I expect to get index1: 0.001

Can you suggest how to do that correctly so I get the expected result?

Re: problem with rounding bytes to gb

richgalloway — Wed, 01 Apr 2020 14:33:31 GMT

Your expected result is not the correct result. 0.00000872090458869934 properly rounds to 0.000. To get a non-zero result, consider converting to MB rather than GB. Or try | eval b = max(0.001, b).
It's not necessary to use foreach to round the results. | eval b = round(b/1024/1024/1024, 3) would work

Re: problem with rounding bytes to gb

net1993 — Wed, 01 Apr 2020 14:46:57 GMT

Thanks. But I have fields for every date so I have 31 fields thats why I use foreach.
About to use MB, what if for some values its more appropriate GB (big number)?
max(0.001, b) if I understand correctly this will do to show the bigger number from the two arguments? If yes then will kind work but thats kind of not what I want
I want to make round function work always but to round to upper border instead of both <5 || >5
I am sure I have seen this in C# but isn't there something similar in splunk?
Tried with ceiling() but this rounds to whole number so not what I need.

Re: problem with rounding bytes to gb

richgalloway — Wed, 01 Apr 2020 15:06:38 GMT

If you convert to MB and the number is big then convert it again to GB. You'll likely want to include units so users know if the display is MB or GB.

| eval B = if(b < 1*1024*1024, b/1024/1024 . " MB", b/1024/1024/1024 . " GB")

Re: problem with rounding bytes to gb

net1993 — Wed, 01 Apr 2020 15:21:46 GMT

I decided to use your first suggestion | eval b = max(0.001, b)
Thank you very much for fast response and smart idea for this.