topic Re: rounding decmials in Splunk Search

rounding decmials

dbagdanoff — Wed, 30 Sep 2020 03:33:24 GMT

I've tried everthing I've found but for some reason cant round the value for "%_Committed_Bytes_In_Use". different variations of things like | eval %_Committed_Bytes_In_Use=round(value,2) but no luck. someone help this newbie. thanks in advance!

index=perfmon eventtype="perfmon_windows" object="Memory" host=$host$| eval DATETIME=strftime(_time, "%D %H:%M") | sort-%_Committed_Bytes_In_Use | table host %_Committed_Bytes_In_Use DATETIME | dedup host

Re: rounding decmials

arjunpkishore5 — Thu, 09 Jan 2020 18:42:19 GMT

Have you tried

| eval %_Committed_Bytes_In_Use=round(%_Committed_Bytes_In_Use,2)

Re: rounding decmials

dbagdanoff — Wed, 30 Sep 2020 03:33:42 GMT

@arjunpkishore5 yes

Error on 'eval' command: The expression is malformed. An unexpected character is reached at '%_Committed_Bytes_In_Use,2)'

I've tried quotation marks, parenthesis in different places. seems the eval command dosent like something in that counter

Re: rounding decmials

jpolvino — Wed, 30 Sep 2020 03:37:18 GMT

Can you please rename your field to Pct_Committed_Bytes_In_Use ? Do this before any operations.

Re: rounding decmials

dbagdanoff — Thu, 09 Jan 2020 21:36:27 GMT

@jpolvino Nice suggestion! worked like a charm. never even thought to rename first.

Re: rounding decmials

jpolvino — Fri, 10 Jan 2020 01:08:17 GMT

A team effort to solve your problem, nice!