topic Re: round number from max () as and also avg() as in Splunk Search

round number from max () as and also avg() as

mmouse88 — Tue, 03 Jun 2014 12:40:17 GMT

I have a created a table using timechart with the max #. It generates a row of maximum of sourcetype. How would I round the max # to 0 decimal. Here's my command:

timechart sum(eval(quantity/12)) span=1h by sourcetype | stats max(*) as *

timechart sum(eval(quantity/12)) span=1h by sourcetype | stats avg(*) as *

Re: round number from max () as and also avg() as

somesoni2 — Tue, 03 Jun 2014 13:39:38 GMT

How about this?

your base search | eval quantity=round(quantity/12) | timechart sum(quantity) span=1h by sourcetype | stats max(*) as *

Try this:

your base search | timechart sum(eval(quantity/12)) span=1h by sourcetype | stats max(*) as * 
| replace *.* with *#* | convert rmunit(*)

*Updated answer*
Don't know why I didn't think of this before. Try this

For max(*) as *

 your base search | bucket span=1h _time  | stats  sum(eval(quantity/12)) as total by _time, sourcetype | eval total=round(total) | eval temp=1| chart first(total) as total  over temp by sourcetype | fields - temp

For avg(*) as *

your base search | bucket span=1h _time  | stats  sum(eval(quantity/12)) as total by _time, sourcetype | stats avg(total) as total by sourcetype | eval total=round(total) | eval temp=1| chart first(total) as total  over temp by sourcetype | fields - temp

Re: round number from max () as and also avg() as

mmouse88 — Tue, 03 Jun 2014 17:36:25 GMT

sorry, it didn't work. results produce all 0s

Re: round number from max () as and also avg() as

somesoni2 — Tue, 03 Jun 2014 17:49:19 GMT

Can you post your current working query? one with no rounding?

Re: round number from max () as and also avg() as

mmouse88 — Tue, 03 Jun 2014 17:52:31 GMT

if i add to your command: eval quantity=round(quantity/12,1). It gives me one decimal place which is pretty close to what I want. would like 0 decimal places. replace ,1 with 0 then results is all 0s.

Re: round number from max () as and also avg() as

somesoni2 — Tue, 03 Jun 2014 17:59:38 GMT

If you want no decimal places then you don't have to specify the precision (see the syntax in my answer).

Re: round number from max () as and also avg() as

mmouse88 — Tue, 03 Jun 2014 18:14:26 GMT

precision, do u mean to remove the divide by 12?

Re: round number from max () as and also avg() as

somesoni2 — Tue, 03 Jun 2014 18:16:23 GMT

Sorry I got confused. Are the values for field quantity less than 6??

Re: round number from max () as and also avg() as

mmouse88 — Tue, 03 Jun 2014 18:31:30 GMT

no worries, my fault. i might not of explain it clearly. without the round my query produce the results #.###### (6 decimal places)

Re: round number from max () as and also avg() as

somesoni2 — Tue, 03 Jun 2014 20:57:16 GMT

Try the updated answer. Note that its not doing the rounding, its just truncating anything after the decimal point.

Re: round number from max () as and also avg() as

mmouse88 — Wed, 04 Jun 2014 00:48:38 GMT

thx. It was able to convert or truncate some values after the decimal. Only 5 values (column 1, 4, 5, 11) had no decimal.

Re: round number from max () as and also avg() as

somesoni2 — Wed, 04 Jun 2014 12:51:59 GMT

Can you paste some of the result which it was not able to truncate?

Re: round number from max () as and also avg() as

mmouse88 — Wed, 04 Jun 2014 17:45:04 GMT

here are the values:
26 7.666636 7 6 5.583311 3.249987 2.999988 2

Re: round number from max () as and also avg() as

somesoni2 — Wed, 04 Jun 2014 18:07:09 GMT

Got another alternative. Try the updated answer.

Re: round number from max () as and also avg() as

mmouse88 — Wed, 04 Jun 2014 18:42:44 GMT

awesome. it worked. Thank you. can i ask for the second part using avg(*) as *

Re: round number from max () as and also avg() as

somesoni2 — Wed, 04 Jun 2014 19:06:25 GMT

See the updated answer. I also updated the previous one to remove _time from final result.

Re: round number from max () as and also avg() as

mmouse88 — Wed, 04 Jun 2014 22:38:19 GMT

Excellent both worked. Thank you so much for your dedication

topic Re: round number from max (*) as * and also avg(*) as * in Splunk Search

round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

Re: round number from max (*) as * and also avg(*) as *

topic Re: round number from max () as and also avg() as in Splunk Search

round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as

Re: round number from max () as and also avg() as