Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Archive

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

g038123

Explorer

01-04-2018
01:34 PM

Hello,

I have the following field values returned from a base search

Field Name

14.2

19.95

InvalidCompositeMsmtA

0

5.6

CompositeIndexInitializing

I need to remove the decimal places without rounding, so the results show as below, which would match what our application displays.

Field Name

14

19

InvalidCompositeMsmtA

0

5

CompositeIndexInitializing

Thank you in advance for any assistance you can provide.

1 Solution

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

outcoldman

Communicator

01-04-2018
03:00 PM

You are looking on something like

```
... | eval InvalidCompositeMsmtA=floor(InvalidCompositeMsmtA)
```

You can find the documentation about floor http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/MathematicalFunctions#floor.28X.29

Highlighted
##

Floor, ceiling, round, or if needed, you could string parse it to chop off everything from decimal after. As @somesoni2 highlight, the formatting of the original post is funky so it's a bit hard to understand if these answers are helping.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

sloshburch

Ultra Champion

01-05-2018
05:22 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

g038123

Explorer

01-05-2018
07:21 AM

Hey, sorry for the confusion, to clarify I have a field named "Index"(Named "Field Name" in original post)

The values of the Index field can be numeric or string as below

14.2

19.95

InvalidCompositeMsmtA

0

5.6

CompositeIndexInitializing

I don't really care about the strings, they're temporary and will update to a numeric value after enough readings have posted. For the purposes of my report, they will generally be ignored.

I do care about the numeric values and would like them to display identical to what is displayed on our application. Floor worked perfectly as I do not want the values rounded, thank you for that!

Given the same data values, if I did need to only update the numeric values and leave the strings untouched, how would I do that? Just curious for future reference and if by chance the requester of the data asks for it. 😉

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

sloshburch

Ultra Champion

01-08-2018
04:12 AM

Check the functions for the eval command and you will discover that you can play with Informational Functions and the Comparison and Conditional functions to test if a value is a string (hint: isstr ) or is a number (hint: isnum ) and then perform the floor only on the numbers.

If you need more help, come back here, but I figured you wanted to learn more about the options available than just this specific answer (teach you to fish).

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

g038123

Explorer

01-09-2018
08:36 AM

Perfect! Thank you Burch

And yes, I'd rather fish 😉

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

somesoni2

SplunkTrust

01-04-2018
03:01 PM

`floor`

which can just bring it down to next lower integer number (no rounding, floor(19.99) will be 19 ).

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

somesoni2

SplunkTrust

01-05-2018
07:33 AM

Try like this

```
your current search | eval "Field Name"=if(match('Field Name',"^[\d\.]*$"),floor('Field Name'),'Field Name')
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

g038123

Explorer

01-05-2018
11:37 AM

Perfect, Thank you!!

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove decimal places without rounding

vikashperiwal

Path Finder

05-24-2019
09:21 PM

i tried doing this way, i want t remove decimal places without rounding. but this did nt work

index=xyx host=* source=*abc*

| eval new*time = uptime/86400 | timechart span=1day avg(new*time) as Days by host| eval Days=if(match('Days',"^[\d.]*$"),floor('Days'),'Days')