Dashboards & Visualizations

How to round decimal places?

mchandx
Path Finder

I have read through the related answers to questions similar to this one, but I just can't make it work for some reason. I am running the following search:

index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalMB = kb/1024 | chart sum(totalMB) as total

and displaying it as a single value on a dashboard. It returns a value with a ton of decimal places and I would like to have it rounded to 2 places.

Any help is greatly appreciated 🙂

Referenced:
http://splunk-base.splunk.com/answers/45110/round-splunk-license-usage
http://splunk-base.splunk.com/answers/8046/rounding-decimal-places

1 Solution

mchandx
Path Finder

Sorry for the delay. I have resolved this issue. There was an issue with the formatting. Here is the correct syntax:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total

View solution in original post

sherm77
Path Finder

Try this, I got joshbronko's working with the addition of a couple asterisks:

index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalMB = round(kb/1024,2) | chart sum(totalMB) as total

mchandx
Path Finder

Sorry for the delay. I have resolved this issue. There was an issue with the formatting. Here is the correct syntax:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total

yannK
Splunk Employee
Splunk Employee

see the eval function round(X,Y)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

example :

index=_internal source=metrics.log group=per_index_thruput series!=_ | eval totalMB = kb/1024 | chart sum(totalMB) as total | eval total=round(total,2)

joshbronko
New Member

index=internal source=metrics.log group=per_index_thruput series!= | eval totalMB = round(kb/1024,2) | chart sum(totalMB) as total

0 Karma

mchandx
Path Finder

Tried that; no luck. It would need to be edited to series!=_ but even that didn't fix it. Also, now the search is returning "N/A"

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...