How do I remove 2 decimal places from values returned in a search?

splunksurekha — Tue, 27 Oct 2015 09:55:17 GMT

When I run the search below, I get correct results without any decimal value in it.

`linux-cpu` | search application=sc10_LMS host=* sub_module=* | stats max(pctLoad) AS pctLoad by host sub_module application | eval Health=if(pctLoad < 50,1,0) | eval Warn=if(pctLoad>= 50 AND pctLoad <80,1,0) | eval Crit=if(pctLoad>=80,1,0) | stats  sum(Crit) as Critical sum(Warn) as Warning sum(Health) as Healthy dc(host) as Total by sub_module | sort - Critical Warning

sub_module  Critical    Warning     Healthy     Total
sc10_LMS_A      4          4         12         20

But when I put the same search in my dashboard which takes arguments from the drop-down like below, it gives me a result with decimal values only for Critical and Warning. How can I get rid of this decimal value?

`linux-cpu` | search application=$application$ host=$host$ sub_module=$submodule$ | stats $function$(pctLoad) AS pctLoad by host sub_module application | eval Health=if(pctLoad < 50,1,0) | eval Warn=if(pctLoad>= 50 AND pctLoad <80,1,0) | eval Crit=if(pctLoad>=80,1,0) | stats  sum(Crit) as Critical sum(Warn) as Warning sum(Health) as Healthy dc(host) as Total by sub_module | sort - Critical Warning

sub_module  Critical    Warning     Healthy     Total
sc10_LMS_A       4.00        4.00      12         20

Re: How do I remove 2 decimal places from values returned in a search?

richgalloway — Tue, 27 Oct 2015 11:48:53 GMT

Try this

... | stats ... | eval Critical=round(Critical,0) | eval Warning=round(Warning,0) | sort ...

topic Re: How do I remove 2 decimal places from values returned in a search? in Splunk Search

How do I remove 2 decimal places from values returned in a search?

Re: How do I remove 2 decimal places from values returned in a search?