topic Re: How to round a number to hundreds or thousands? in Splunk Search

How to round a number to hundreds or thousands?

HeinzWaescher — Fri, 28 Aug 2020 17:39:11 GMT

HI,

I want to create tables that are easier to read and round the numbers to hundreds or thousands. Like

22113 -> 22100 or
22113 -> 22000

How can I achieve this?

Thanks in advance
Heinz

dineshraj9 — Wed, 05 Jul 2017 08:46:22 GMT

You can use eval and do it this way -
To 100s -

| makeresults | eval number=22113 | eval number=number-(number%100)

To 1000s -

| makeresults | eval number=22113 | eval number=number-(number%1000)

niketn — Wed, 05 Jul 2017 09:12:13 GMT

Is there a restriction to prefixing or suffixing the number with padded 0s?
Following examples will pad leading zeros and retain original number

Using printf (Splunk 6.6 onwards)

| makeresults
| eval number= 581
| fieldformat number=printf("%04d",number)

HeinzWaescher — Wed, 05 Jul 2017 14:56:16 GMT

Thanks, we are still on 6.5, so I'm currently not able to try it out

HeinzWaescher — Wed, 05 Jul 2017 14:57:37 GMT

Thanks for your reply.

| makeresults | eval number=22913 | eval number=number-(number%1000)

The above will end up with 22000 instead of 23000, so its more cutting that rounding. Is there a way to fix this?

sbbadri — Wed, 05 Jul 2017 15:20:49 GMT

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

verbal_666 — Fri, 28 Aug 2020 09:53:37 GMT

Great!!! 👍