topic Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result? in Splunk Search

Can I use modulus in Splunk to extract the decimal portion (only) of a result?

nittalasub — Sat, 12 Aug 2017 22:40:07 GMT

how to extract only decimal values in splunk ? ..example (7 divided by 2 ) = 3.5 , I need to get only 0.5 here ...will "%" work (or) is there any MOD funciton to accomplish this task ?

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

richgalloway — Sat, 12 Aug 2017 23:04:04 GMT

Splunk does support the modulus (%) operator.

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

jkat54 — Sun, 13 Aug 2017 03:08:16 GMT

So it would look like this?

 ... | eval remainder=7%2

Correct? I've never done it before.

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

niketn — Sun, 13 Aug 2017 05:18:44 GMT

Following is the run anywhere search. While modular division is possible, you are actually looking just to extract decimal places.

| makeresults
| eval dividend=7
| eval divisor=2
| eval value=dividend/divisor
| eval remainder=dividend%divisor
| eval quotient=replace(value,"(\d+).(\d+)","\1")
| eval decimal=replace(value,"(\d+)(\.\d+)","0\2")
| table dividend divisor value remainder quotient decimal

Following are the results:

dividend    divisor value   remainder   quotient    decimal
7          2          3.5     1         3          0.5

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

DalJeanis — Sun, 13 Aug 2017 20:38:18 GMT

@jkat54 - correct, but one more step to get the requested answer...

  ... | eval decimal=(7%2)/2

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

DalJeanis — Sun, 13 Aug 2017 20:40:38 GMT

@niketnilay - Great demo, but modulo arithmetic does simplify the calculation down to ..

  ... | eval decimal=(7%2)/2

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

niketn — Mon, 14 Aug 2017 02:40:35 GMT

@DalJeanis, I need to take not just Splunk lessons from you but maths also 🙂

How about dividend < divisor? like (3/7)?

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

DalJeanis — Mon, 14 Aug 2017 03:19:44 GMT

3%7 is 3, so (3%7)/7 = 3/7

The formula only fails (potentially)for negative numbers.

Depending on implementation -3%7 can be considered to be either -3 or +4. Those two numbers are identities in mod 7 ring theory and whatever the other relevant branches of discrete math are.... but not when you are calculating real world stuff.

So, for safety, if I couldn't run a quick test, I'd end up coding that as...

   decimal=round(if(X<0, -(-X%Y)/Y,(X%Y)/Y),somenumber)

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

nittalasub — Mon, 14 Aug 2017 05:12:06 GMT

@Daljeanis -- thank you so much ! 🙂 that helped me to extract decimals from floating point numbers.

special thanks to Nike !

Re: Can I use modulus in Splunk to extract the decimal portion (only) of a result?

niketn — Mon, 14 Aug 2017 05:49:03 GMT

@nittalasub, I have converted @DalJeanis' comment to answer. Please accept to mark this question as answered. Kindly also up vote other comments that helped.