https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306346#M165603 <P>HI,</P> <P>a=0.54689556898<BR /> b=1.25698<BR /> c=0.5<BR /> d=51</P> <P>I want output like</P> <P>a=0.54<BR /> b=1.25<BR /> c=0.50<BR /> d=51.00</P> <P>Please do needful, how to write query</P> <P>i tried with this query but i am not getting<BR /> | makeresults |eval Total=0.8 | rex Field=Total "(?.<EM>).(?.</EM>)" |eval EMP2=substr(FieldC,0,len(FieldC)-1) | eval Result= FieldB.".".EMP2 |eval Result1=round(Result,3) | eval EMP5=substr(Result1,0,len(Result1)-1) | fields - FieldC, EMP2, FieldB, Result, Result1, _time</P> Fri, 13 Oct 2017 10:09:45 GMT venu08673 2017-10-13T10:09:45Z https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306346#M165603 <P>HI,</P> <P>a=0.54689556898<BR /> b=1.25698<BR /> c=0.5<BR /> d=51</P> <P>I want output like</P> <P>a=0.54<BR /> b=1.25<BR /> c=0.50<BR /> d=51.00</P> <P>Please do needful, how to write query</P> <P>i tried with this query but i am not getting<BR /> | makeresults |eval Total=0.8 | rex Field=Total "(?.<EM>).(?.</EM>)" |eval EMP2=substr(FieldC,0,len(FieldC)-1) | eval Result= FieldB.".".EMP2 |eval Result1=round(Result,3) | eval EMP5=substr(Result1,0,len(Result1)-1) | fields - FieldC, EMP2, FieldB, Result, Result1, _time</P> Fri, 13 Oct 2017 10:09:45 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306346#M165603 venu08673 2017-10-13T10:09:45Z https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306347#M165604 <P>EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.</P> <P><STRONG>Rounding</STRONG> a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...</P> <PRE><CODE>| makeresults | eval nums=split("0.54689556898 1.25698 0.5 51", " ") | mvexpand nums | eval num_2 = round(nums,2) </CODE></PRE> <P>My results are </P> <PRE><CODE>num_2 nums 51.00 51 1.26 1.25698 0.55 0.54689556898 0.50 0.5 </CODE></PRE> <P><STRONG>Truncation:</STRONG> If instead you really need truncation, combine the above technique with a rex.</P> <PRE><CODE>| makeresults | eval nums=split("0.54689556898 1.25698 0.5 51", " ") | mvexpand nums | eval num_2 = round(nums,3) | rex field=num_2 "(?&lt;num&gt;\d+\.\d{2})" </CODE></PRE> <P>What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.</P> <P>That truncates like I think you might want!</P> <P>Happy Splunking! Let me know if this works for you!</P> <P>-Rich</P> Fri, 13 Oct 2017 11:40:53 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306347#M165604 Richfez 2017-10-13T11:40:53Z https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306348#M165605 <P>Hi<BR /> did you tried with round function?</P> <PRE><CODE>| eval your_field=round(your_field,2) </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 13 Oct 2017 11:43:19 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306348#M165605 gcusello 2017-10-13T11:43:19Z https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306349#M165606 <P>Finally i got output.</P> <P>Thank you Very much bro</P> Fri, 13 Oct 2017 12:37:13 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306349#M165606 venu08673 2017-10-13T12:37:13Z https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306350#M165607 <P>If your problem is resolved, please accept an answer to help future readers.</P> Fri, 13 Oct 2017 12:49:19 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-show-two-decimals-after-integer-without-changing/m-p/306350#M165607 richgalloway 2017-10-13T12:49:19Z