Dashboards & Visualizations

How to roundoff the results to 2 decimal digits?

SG
Path Finder

HI,

I have a search query as below

 

 

index= **** | stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service

 

 

 

It gives me results as below...

 

SG_0-1647600836749.png

 i wanted to roundoff the decimal values to 2 digits for all column values. I tried something like this but it didnt give me any results, Can you please help me how can i trim the results to 2 digits.

 

 

 

index= **** | eval upstream_response_times = round(upstream_response_time,2) | stats avg(upstream_response_times), p95(upstream_response_times), p99(upstream_response_times) by service

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index= **** 
| stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service
| foreach *upstream_response_time*
  [| eval "<<FIELD>>"=round('<<FIELD>>',2)]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index= **** 
| stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service
| foreach *upstream_response_time*
  [| eval "<<FIELD>>"=round('<<FIELD>>',2)]
0 Karma

SG
Path Finder

Thank a lot, Its working.

Tags (2)
0 Karma

SG
Path Finder

Tried the below ways, but the result is not trimmed to 2 digits

 

index= ****
| stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service
| foreach "upstream_response_time"
  [| eval "upstream_response_time"=round('upstream_response_time',2)]


index= ****
| stats avg(upstream_response_time), p95(upstream_response_time), p99(upstream_response_time) by service
| foreach *upstream_response_time*
  [| eval "upstream_response_time"=round('upstream_response_time',2)]
0 Karma

PickleRick
SplunkTrust
SplunkTrust

'<<FIELD>>'  was not used here by @ITWhisperer as a string to replace by you. It should have been pasted as is. It's a placeholder to be replaced during the search by the field name matched by foreach.

See https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Foreach

You might consider using fieldformat instead of eval but that can lead to some hard to spot inconsistencies if you plan to further process the fields down the pipeline.

0 Karma

SG
Path Finder

Even as is if i mention the field name also it is not rounding off the results.

 

SG_0-1647833902408.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

In the eval statement, put the word

<<FIELD>>

as directed by @ITWhisperer and NOT what you have put. 

0 Karma

SG
Path Finder

HI,

I applied the same and it is working fine. Thanks!!!

Tags (1)
0 Karma

SG
Path Finder

Even that is not helping me to roundoff the column values.

SG_0-1647837549630.png

I wanted to mention one more thing here, i.e, the values i am planning to search here are written to summary index from the original index.

Thanks,

SG

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try doing the foreach exactly as I suggested

0 Karma

PickleRick
SplunkTrust
SplunkTrust

This time you omitted the asterisks around the partial field name.

Please see https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Foreach for the description how foreach works.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...