I have the following field values returned from a base search
I need to remove the decimal places without rounding, so the results show as below, which would match what our application displays.
Thank you in advance for any assistance you can provide.
You are looking on something like
... | eval InvalidCompositeMsmtA=floor(InvalidCompositeMsmtA)
You can find the documentation about floor http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/MathematicalFunctions#floor.28X.29
Floor, ceiling, round, or if needed, you could string parse it to chop off everything from decimal after. As @somesoni2 highlight, the formatting of the original post is funky so it's a bit hard to understand if these answers are helping.
Hey, sorry for the confusion, to clarify I have a field named "Index"(Named "Field Name" in original post)
The values of the Index field can be numeric or string as below
I don't really care about the strings, they're temporary and will update to a numeric value after enough readings have posted. For the purposes of my report, they will generally be ignored.
I do care about the numeric values and would like them to display identical to what is displayed on our application. Floor worked perfectly as I do not want the values rounded, thank you for that!
Given the same data values, if I did need to only update the numeric values and leave the strings untouched, how would I do that? Just curious for future reference and if by chance the requester of the data asks for it. 😉
Check the functions for the eval command and you will discover that you can play with Informational Functions and the Comparison and Conditional functions to test if a value is a string (hint: isstr ) or is a number (hint: isnum ) and then perform the floor only on the numbers.
If you need more help, come back here, but I figured you wanted to learn more about the options available than just this specific answer (teach you to fish).
The output format you've put may be little confusing. What are the names of the fields that contains those decimal values? Are the names of those columns fixed/static? There is a function called
floor which can just bring it down to next lower integer number (no rounding, floor(19.99) will be 19 ).
Try like this
your current search | eval "Field Name"=if(match('Field Name',"^[\d\.]*$"),floor('Field Name'),'Field Name')
i tried doing this way, i want t remove decimal places without rounding. but this did nt work
index=xyx host=* source=abc
| eval newtime = uptime/86400 | timechart span=1day avg(newtime) as Days by host| eval Days=if(match('Days',"^[\d.]*$"),floor('Days'),'Days')