topic Re: How to display summed results that are less than 1 in a table? in Splunk Search

How to display summed results that are less than 1 in a table?

tapptress — Thu, 04 Aug 2016 16:30:46 GMT

I have values in a field that, when summed, are values less than 1 (ie, .79 .03). I need these values to display in my table, but they currently do not. I assume it is because they are a value less than 1. They display when they aren't summed, so is there a way to format a summed value so it will display these smaller values?

Re: How to display summed results that are less than 1 in a table?

richgalloway — Thu, 04 Aug 2016 16:50:28 GMT

Using round or exact in your eval may help. Show us your query for a better answer.

Re: How to display summed results that are less than 1 in a table?

twinspop — Thu, 04 Aug 2016 20:05:54 GMT

Splunk does not round or truncate numbers by default in any situations I'm aware of. Can you provide sample logs, searches and results?

Re: How to display summed results that are less than 1 in a table?

tapptress — Mon, 15 Aug 2016 18:24:58 GMT

I'm basically just summing duration times for a particular device outage

|stats sum(Duration) as Duration by Sensor -- my search returns 3 values to sum [.03, 4.75, and 7.24] -- the result is 11.99, it seems to be ignoring the .03 value

Re: How to display summed results that are less than 1 in a table?

somesoni2 — Mon, 15 Aug 2016 18:32:36 GMT

Can you run this and share results (for the Sensor you're seeing issue)

your base search | table Sensor Duration | appendpipe [|stats sum(Duration) as Duration by Sensor]

Re: How to display summed results that are less than 1 in a table?

tapptress — Mon, 15 Aug 2016 18:39:52 GMT

I have all of that
base search, I did stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor |appendpipe [|stats sum(Duration) as Duration by Sensor]

I get everything I want with the exception of any duration that is less than 1 is ignored. How do I get the sum functions to add the 0.something values?

Re: How to display summed results that are less than 1 in a table?

somesoni2 — Mon, 15 Aug 2016 18:45:32 GMT

I'm guessing the number format could be the issue here. Could you try this

stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor | convert num(Duration) |appendpipe [|stats sum(Duration) as Duration by Sensor]

Re: How to display summed results that are less than 1 in a table?

tapptress — Mon, 15 Aug 2016 18:47:07 GMT

Same result. 11.99 when it should be 12.02

Re: How to display summed results that are less than 1 in a table?

somesoni2 — Mon, 15 Aug 2016 21:37:24 GMT

Seems like the value .03 is not recognized as proper decimal number. Give this a try

| eval Duration=if(substr(Duration,1,1)=".","0".Duration,Duration) | stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor | convert num(Duration) |stats sum(Duration) as Duration by Sensor

Re: How to display summed results that are less than 1 in a table?

tapptress — Tue, 16 Aug 2016 15:56:16 GMT

Thanks. This appears to have worked. Really appreciate it!