I have the following field values returned from a base search
I need to remove the decimal places without rounding, so the results show as below, which would match what our application displays.
Thank you in advance for any assistance you can provide.
i tried doing this way, i want t remove decimal places without rounding. but this did nt work
index=xyx host=* source=abc
| eval new_time = uptime/86400 | timechart span=1day avg(new_time) as Days by host| eval Days=if(match('Days',"^[\d.]*$"),floor('Days'),'Days')
@vikashperiwal - time is a bit "fun" to play with and I suggest making a whole new post for that question (and then share the link here so we can help you) so we can dive deep with you.
There could be a number of options or approaches depending on your situation. For example, your question could be solved with a tweak to the sourcetype (to modify the time) that could solve your challenge with the `date*` fields.
The output format you've put may be little confusing. What are the names of the fields that contains those decimal values? Are the names of those columns fixed/static? There is a function called
floor which can just bring it down to next lower integer number (no rounding, floor(19.99) will be 19 ).
You are looking on something like
... | eval InvalidCompositeMsmtA=floor(InvalidCompositeMsmtA)
You can find the documentation about floor http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/MathematicalFunctions#floor.28X.29
Floor, ceiling, round, or if needed, you could string parse it to chop off everything from decimal after. As @somesoni2 highlight, the formatting of the original post is funky so it's a bit hard to understand if these answers are helping.
Hey, sorry for the confusion, to clarify I have a field named "Index"(Named "Field Name" in original post)
The values of the Index field can be numeric or string as below
I don't really care about the strings, they're temporary and will update to a numeric value after enough readings have posted. For the purposes of my report, they will generally be ignored.
I do care about the numeric values and would like them to display identical to what is displayed on our application. Floor worked perfectly as I do not want the values rounded, thank you for that!
Given the same data values, if I did need to only update the numeric values and leave the strings untouched, how would I do that? Just curious for future reference and if by chance the requester of the data asks for it. 😉
Check the functions for the eval command and you will discover that you can play with Informational Functions and the Comparison and Conditional functions to test if a value is a string (hint: isstr ) or is a number (hint: isnum ) and then perform the floor only on the numbers.
If you need more help, come back here, but I figured you wanted to learn more about the options available than just this specific answer (teach you to fish).