Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results forย

Archive

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results forย

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

venu08673

New Member

โ10-13-2017
03:09 AM

HI,

a=0.54689556898

b=1.25698

c=0.5

d=51

I want output like

a=0.54

b=1.25

c=0.50

d=51.00

Please do needful, how to write query

i tried with this query but i am not getting

| makeresults |eval Total=0.8 | rex Field=Total "(?.*).(?.*)" |eval EMP2=substr(FieldC,0,len(FieldC)-1) | eval Result= FieldB.".".EMP2 |eval Result1=round(Result,3) | eval EMP5=substr(Result1,0,len(Result1)-1) | fields - FieldC, EMP2, FieldB, Result, Result1, _time

1 Solution

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Richfez

SplunkTrust

โ10-13-2017
04:40 AM

EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.

**Rounding** a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...

```
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,2)
```

My results are

```
num_2 nums
51.00 51
1.26 1.25698
0.55 0.54689556898
0.50 0.5
```

**Truncation:** If instead you really need truncation, combine the above technique with a rex.

```
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,3)
| rex field=num_2 "(?<num>\d+\.\d{2})"
```

What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.

That truncates like I think you might want!

Happy Splunking! Let me know if this works for you!

-Rich

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

gcusello

Legend

โ10-13-2017
04:43 AM

Hi

did you tried with round function?

```
| eval your_field=round(your_field,2)
```

Bye.

Giuseppe

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Richfez

SplunkTrust

โ10-13-2017
04:40 AM

EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.

**Rounding** a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...

```
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,2)
```

My results are

```
num_2 nums
51.00 51
1.26 1.25698
0.55 0.54689556898
0.50 0.5
```

**Truncation:** If instead you really need truncation, combine the above technique with a rex.

```
| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,3)
| rex field=num_2 "(?<num>\d+\.\d{2})"
```

What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.

That truncates like I think you might want!

Happy Splunking! Let me know if this works for you!

-Rich

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

venu08673

New Member

โ10-13-2017
05:37 AM

Finally i got output.

Thank you Very much bro

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

richgalloway

SplunkTrust

โ10-13-2017
05:49 AM

If your problem is resolved, please accept an answer to help future readers.

---

If this reply helps you, an upvote would be appreciated.

If this reply helps you, an upvote would be appreciated.