topic Re: limit timechart average values to two places in Splunk Search

limit timechart average values to two places

dang — Mon, 22 Jul 2013 23:29:16 GMT

I'm attempting to look at average free memory in GB on a number of servers (named server01, server02, etc) over time.

Doing this simple query I get the information I'm looking for, and the data is in gigabytes:

eventtype="windows_performance" Host="server*" object="Memory" counter="Available MBytes" |  eval FreeGB=(Value/1024) | timechart span=30m avg(FreeGB) by Host

The problem I'm encountering is that I'd like to present the timecharted values as having only two decimal places, and I can't figure out how. Using "round" in the eval statement [for example eval FreeGB=round((Value/1024),2)] doesn't seem to work.

Any suggestions?

Re: limit timechart average values to two places

HiroshiSatoh — Mon, 22 Jul 2013 23:49:56 GMT

"ROUND" is okay. Do you want to be a display what results? Value Is it a numeric type?Error Is the output to "search.log"?

round((tonumber(Value)/1024),2)

Re: limit timechart average values to two places

martin_mueller — Tue, 23 Jul 2013 06:53:04 GMT

You could roll it all into one eval timechart function:

... | timechart span=30m eval(round(avg(Value)/1024,2)) by Host

That will compute the average, convert to GB, and round to tens of MB.

Re: limit timechart average values to two places

dang — Tue, 23 Jul 2013 15:07:17 GMT

Thank you, Martin. That was the answer I was looking for.

Re: limit timechart average values to two places

mattymo — Tue, 29 Sep 2020 14:17:10 GMT

Just a heads up for anyone trying this, that eval naming is still required. Martin's example does it with the 'by' clause, or you can use the 'AS' to rename.

Won't work:

| timechart span=15m eval(round(avg(RMS_Watts_Tot),2))

^^ Error in 'timechart' command: The eval expression 'eval(round(avg(RMS_Watts_Tot),2))' must be renamed.

Works:

| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) AS watts
| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) by host