https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47073#M179406 <P>More details please? How is it not working? What search string are you using?</P> Wed, 28 Nov 2012 11:46:35 GMT Ayn 2012-11-28T11:46:35Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47072#M179405 <P>hi all,<BR /> i just want to round some values in secs. i tried with round and floor options. but it is not working. i extracted this field by sing MV_ADD option..<BR /> please help<BR /> thank u</P> Wed, 28 Nov 2012 11:38:33 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47072#M179405 smolcj 2012-11-28T11:38:33Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47073#M179406 <P>More details please? How is it not working? What search string are you using?</P> Wed, 28 Nov 2012 11:46:35 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47073#M179406 Ayn 2012-11-28T11:46:35Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47074#M179407 <P>index=main source=bbb.txt field1=*| eval btime=round(b1time,2)|table field1 btime b1time<BR /> now btime firld is empty<BR /> i extracted it using MV_ADD option because all these field value come under one event i.e <BR /> [get_b1time]<BR /> REGEX=""<BR /> MV_ADD=true<BR /> it worked fine and b1time valuees are correct.</P> Mon, 28 Sep 2020 12:52:35 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47074#M179407 smolcj 2020-09-28T12:52:35Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47075#M179408 <P>The following search will illustrate the different results you can expect from the <CODE>floor, round</CODE> and <CODE>ceil</CODE> functions. I've used the time as input, since you can easily reproduce the results. </P> <P><CODE>* | head 1 | eval XX = _time / 1000000 | eval floorX = floor(XX) | eval r0X = round(XX,0) | eval r1X = round(XX,1) | eval r3X = round(XX,3) | eval ceilX = ceil(XX) | table XX, floorX, r0X, r1X, r3X, ceilX</CODE></P> <P>/k</P> Wed, 28 Nov 2012 12:04:08 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47075#M179408 kristian_kolb 2012-11-28T12:04:08Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47076#M179409 <P>i am sorry for this late update,, but if there is only one value per event , then it is working,, wats wrong when extracting multiple values from same event</P> Wed, 28 Nov 2012 12:36:24 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47076#M179409 smolcj 2012-11-28T12:36:24Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47077#M179410 <P>Perhaps using <CODE>mvexpand</CODE> could solve your issue?</P> Wed, 28 Nov 2012 12:49:12 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47077#M179410 Ayn 2012-11-28T12:49:12Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47078#M179411 <P>appreciating your effort,, but mvexpand is working only for one multivalue field extraction in one event,, but i have three ..</P> Wed, 28 Nov 2012 13:35:32 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47078#M179411 smolcj 2012-11-28T13:35:32Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47079#M179412 <P>Dirty floor() workaround for multivalued fields </P> <P>Given these non-integer values </P> <PRE><CODE>| gentimes start=-1 increment=1h | stats list(eval(starttime/1000)) as times </CODE></PRE> <P>run this :</P> <PRE><CODE>... | eval times=mvjoin(times,";") | rex mode=sed field=times "s/\.[0-9]+//g" | eval times=split(times,";") </CODE></PRE> <P>This is assuming that the times you have are in epoch format, but should work for other data formats too.</P> <P>The other alternative is to mvzip up all your multivalued fields into a new field, mvexpand the new field, extract out the time field, perform your floor function on it, then join everything up again.</P> Wed, 28 Nov 2012 14:24:52 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47079#M179412 jonuwz 2012-11-28T14:24:52Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47080#M179413 <P><A href="http://splunk-base.splunk.com/answers/66840/how-to-sum-output-of-table-command">http://splunk-base.splunk.com/answers/66840/how-to-sum-output-of-table-command</A></P> Thu, 29 Nov 2012 08:33:09 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47080#M179413 smolcj 2012-11-29T08:33:09Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47081#M179414 <P>Dirtyfloor? can u explain a little bit</P> Thu, 29 Nov 2012 11:48:34 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47081#M179414 smolcj 2012-11-29T11:48:34Z https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47082#M179415 <P>It emulates floor without having to split the values into seperate events</P> Thu, 20 Dec 2012 18:27:56 GMT https://community.splunk.com/t5/Splunk-Search/using-round-floor-function/m-p/47082#M179415 jonuwz 2012-12-20T18:27:56Z