topic Re: Round down in Splunk Search

Round down

KaliBaker — Tue, 26 Jun 2012 18:38:28 GMT

I have a function where I take a number, divide it by 3, then would like to round that number down. Is that possible to do in Splunk? Could I instead use something like split()?

Re: Round down

lpolo — Tue, 26 Jun 2012 19:00:31 GMT

Try the round function:
As presented in the documentation:

round(X,Y): This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y. The default is to round to an integer.

This example returns 4:

|eval test=round(3.5)

This example returns 2.56:

|eval test=round(2.555, 2)

Re: Round down

KaliBaker — Tue, 26 Jun 2012 20:16:35 GMT

The problem with that is I want it to round DOWN not just round. That function doesn't let me do that as far as I know.

Re: Round down

cphair — Tue, 26 Jun 2012 21:14:52 GMT

Use eval's floor function.



| eval foo=floor(Value/3)

This gives you an integer, but if you really need to maintain some decimal places you could do some extra math, like eval foo=(floor(Value*100/3))/100 to get 2 places.

Re: Round down

lpolo — Mon, 28 Sep 2020 11:59:51 GMT

You will need the floor function. If you use round it will round up your number if the decimal is greater or equal to .5. And it will round down if you decimal is less than .5. Example:

your query|eval x=7/3 |eval x_round=round(x)|eval x_floor=floor(x) |table x x_round x_floor

Result set:

x x_round x_floor
2.333333 2 2