topic Re: Problems with rounding in Splunk Search

Problems with rounding

rgcox1 — Thu, 22 Jul 2010 06:29:40 GMT

Having difficulty with simple rounding.

 index=_internal  group=per_sourcetype_thruput | eval gb=round(kb/1048576, 2)| stats sum(gb) sum(kb) by series |sort -sum(gb)

Incorrect GB in result:
series sum(gb) sum(kb)
wineventlog:security 1.66 4727905.487416

index=_internal  group=per_sourcetype_thruput | eval gb=kb/1048576| stats sum(gb) sum(kb) by series |sort -sum(gb)

Correct GB in result without rounding:
series sum(gb) sum(kb)
wineventlog:security 4.5088820335775 4727905.487416

Have tried various versions of the base formula:
gb=round(kb/104856)
gb=round((kb/1024/1024), 2)
gb=round(((kb/1024)/1024), 2)
gb=round(kb/1024/1024)

But nothing works. What am I doing wrong?

Re: Problems with rounding

gkanapathy — Thu, 22 Jul 2010 06:46:34 GMT

If you round before summing up the values, you round off most of it before you can actually add it up. Most of the kb values are small. If you divide any number less than 10,000 by 1,000,000 (or 1,048,576) and round to 2 places, it comes out to zero, so you end up adding up a whole bunch of zeros.

The solution is to round after you sum, e.g.:

index=_internal group=per_sourcetype_thruput
| stats sum(kb) as sum_kb by series
| eval sum_gb=round(sum_kb/1048576,2)

Re: Problems with rounding

assaftoval — Tue, 24 May 2011 08:52:53 GMT

The solution above it not working..

Re: Problems with rounding

rishiaggarwal — Wed, 19 Oct 2016 02:17:37 GMT

I downvoted this post because solution is not working

Re: Problems with rounding

ashishganger — Tue, 29 Sep 2020 11:27:46 GMT

I think you need to sum the data in KB by Host rather than series. Each host has multiple sources and source types. It would be better to monitor the data throughput per host then series. Use the below search query:

index=_internal group=per_sourcetype_thruput | stats sum(kb) as DataKB, avg(kbps) as AVG-KBPS by host | eval DataGB=round(DataKB/1048576,2) | sort DataGB

Re: Problems with rounding

ashishganger — Wed, 19 Oct 2016 08:21:05 GMT

Also mind that there should be no space while using the round function 🙂