HI,
a=0.54689556898
b=1.25698
c=0.5
d=51
I want output like
a=0.54
b=1.25
c=0.50
d=51.00
Please do needful, how to write query
i tried with this query but i am not getting
| makeresults |eval Total=0.8 | rex Field=Total "(?.).(?.)" |eval EMP2=substr(FieldC,0,len(FieldC)-1) | eval Result= FieldB.".".EMP2 |eval Result1=round(Result,3) | eval EMP5=substr(Result1,0,len(Result1)-1) | fields - FieldC, EMP2, FieldB, Result, Result1, _time
EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.
Rounding a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,2)
My results are
num_2 nums
51.00 51
1.26 1.25698
0.55 0.54689556898
0.50 0.5
Truncation: If instead you really need truncation, combine the above technique with a rex.
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,3)
| rex field=num_2 "(?<num>\d+\.\d{2})"
What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.
That truncates like I think you might want!
Happy Splunking! Let me know if this works for you!
-Rich
Hi
did you tried with round function?
| eval your_field=round(your_field,2)
Bye.
Giuseppe
EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.
Rounding a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,2)
My results are
num_2 nums
51.00 51
1.26 1.25698
0.55 0.54689556898
0.50 0.5
Truncation: If instead you really need truncation, combine the above technique with a rex.
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,3)
| rex field=num_2 "(?<num>\d+\.\d{2})"
What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.
That truncates like I think you might want!
Happy Splunking! Let me know if this works for you!
-Rich
Finally i got output.
Thank you Very much bro
If your problem is resolved, please accept an answer to help future readers.