topic Re: Rounding to -2 works but not -3? in Splunk Search

Rounding to -2 works but not -3?

kearaspoor — Tue, 29 Sep 2020 14:06:38 GMT

Working on a search that will monitor when the searches that populate a summary index run and I'm needing to round the epoch time of when the search started to the closest hour.

| eval runtime=strftime(info_search_time, "%m/%d/%y %H")
Appropriately groups things but doesn't allow me to perform further calculations on the time value
I've also tried re-converting this timestamp to epoch using strptime(runtime,"%s") but it doesn't work unless I include the minute/second details... I haven't figured out how to replace those with zeros.

| eval RUNTIME=round(info_search_time,0)
appropriately removes the numbers to the right of the decimal, leaving just an integer.

To my pleasant surprise, I found that:
| eval RUNTIME=round(info_search_time,-2)
rounds the epoch time to: ########00

But when I try:
| eval RUNTIME=round(info_search_time,-3)
instead of getting #######000, as I'd like, I'm getting -nan

Any idea why rounding to -3 isn't allowed or if there's some other approach I should be trying?

Thank you!

Re: Rounding to -2 works but not -3?

somesoni2 — Tue, 29 Sep 2020 14:06:41 GMT

If all you need is to round the value of info_search_time rounded to hour, use the bucket command.

...| bucket span=1h info_search_time

It'll keep the value in epoch and round/bucket it to hour length.

Re: Rounding to -2 works but not -3?

kmorris_splunk — Wed, 17 May 2017 20:15:41 GMT

Check out the accepted answer in this post:

https://answers.splunk.com/answers/200468/round-problem.html

I have tested this (see screenshot)

Re: Rounding to -2 works but not -3?

kearaspoor — Wed, 17 May 2017 20:27:47 GMT

The comment made by somesoni2, recommending the bucket command worked like a charm but I can't accept it as the correct answer because it was posted as a comment. 😞 If it gets moved I'll accept it as a great answer. Thank you!

Re: Rounding to -2 works but not -3?

woodcock — Wed, 17 May 2017 20:38:07 GMT

You should open a support case; I made a comment on the documentation page.

Re: Rounding to -2 works but not -3?

aaraneta_splunk — Wed, 17 May 2017 21:03:07 GMT

@kearaspoor - I have moved somesoni2's comment to an answer that you can accept. Thanks for leaving that comment saying it helped you 🙂