How to round decimal places?

[mchandx]

I have read through the related answers to questions similar to this one, but I just can't make it work for some reason. I am running the following search:

index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalMB = kb/1024 | chart sum(totalMB) as total

and displaying it as a single value on a dashboard. It returns a value with a ton of decimal places and I would like to have it rounded to 2 places.

Any help is greatly appreciated 🙂

Referenced:
http://splunk-base.splunk.com/answers/45110/round-splunk-license-usage
http://splunk-base.splunk.com/answers/8046/rounding-decimal-places

[sherm77]

Try this, I got joshbronko's working with the addition of a couple asterisks:

index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalMB = round(kb/1024,2) | chart sum(totalMB) as total

[mchandx · Accepted solution]

Sorry for the delay. I have resolved this issue. There was an issue with the formatting. Here is the correct syntax:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total

[yannK]

see the eval function round(X,Y)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

example :

index=_internal source=metrics.log group=per_index_thruput series!=_ | eval totalMB = kb/1024 | chart sum(totalMB) as total | eval total=round(total,2)

[joshbronko]

index=internal source=metrics.log group=per_index_thruput series!= | eval totalMB = round(kb/1024,2) | chart sum(totalMB) as total

[mchandx]

Tried that; no luck. It would need to be edited to series!=_ but even that didn't fix it. Also, now the search is returning "N/A"