Is it possible to add "%" next to the value?

[Sureshp191]

Please help on the following:
1) Instead of values 2.8685303234545950 I want to restrict to 2 decimal places like 2.87

2) I want to append "%"  at the end of 2.87, like 2.87%

index=MyPCF
| fields server_instance cpu_percentage
| timechart mAX(cpu_percentage) as CPU_Percentage by server_instance usenull=true limit=0

Below is the current output I get:

_time	server1	sevrer3	server4	server5
2024-03-21 13:45:00	3.1049753795247880	2.6818978525900086	3.0970366478143334	2.6279363289367494
2024-03-21 13:46:00	2.9336478352933097	2.4579778020150926	2.9602531790679110	2.9074405642281490
2024-03-21 13:47:00	2.9608714340953393	2.5579155086951600	2.7920194409649772	3.2610313588043978
2024-03-21 13:48:00	3.5946875229937634	2.5006464331193965	3.1106486461269176	3.7073668015974173
2024-03-21 13:49:00	2.8303159134216944	3.5756938476048900	3.4757319466032990	2.9783098006952250
2024-03-21 13:50:00	3.0067950036354420	2.2524125280871740	3.0493445107055930	2.2877333705021860
2024-03-21 13:51:00	2.7526861431818790	2.5427731042748785	3.0946836167596232	2.7477304760698664
2024-03-21 13:52:00	3.4172636751835066	2.730991461075761	2.7698859629286040	2.6296901815909903
2024-03-21 13:53:00	2.5957496530754254	2.1086391909665694	2.6025759149116060	2.4142703772570730
2024-03-21 13:54:00	2.7321368209680920	2.5317849096196980	2.8368213301356677	3.0664957483386470

[ITWhisperer]

Try something like this

| foreach *
  [| eval "<<FIELD>>"=round('<<FIELD>>',2)."%"]

[Sureshp191]

I tried this but getting the same result, % not getting uppended to cpu_percent value

index=MyPCF
| fields server_instance cpu_percentage
| foreach * [| eval cpu_percent=round('cpu_percentage',2)."%"]
| timechart mAX(cpu_percent) as CPU_Percentage by server_instance usenull=true limit=0

[PickleRick]

No.

Firstly, using foreach with staticaly named fields makes no sense.

Secondly, you should modify your results _after_ the timechart.

Thirdly, I prefer using fieldformat in such case, not eval - this way you can display values with the format you want but not lose the original values.

So use the solution @ITWhisperer showed but afhter your timechart command (and you can replace the eval command with fieldformat as I wrote).

[Sureshp191]

Hi, 
Thanks for the reply, I am still learning splunk pardon for my ignorance. I tried as you mentioned

index=MyPCF
| fields server_instance cpu_percentage
| timechart mAX(cpu_percentage) as CPU_Percentage by server_instance usenull=true limit=0
| foreach * [| fieldformat cpu_percentage=round('cpu_percentage',2)."%"]

Still same result

Time	Server1	Server2
2024-03-21T15:00:00.000-0400	1.869638272	2.384320706
2024-03-21T15:01:00.000-0400	1.879958176	2.083629971
2024-03-21T15:02:00.000-0400	8.669585777	8.115720288
2024-03-21T15:03:00.000-0400	1.907194392	2.248362057
2024-03-21T15:04:00.000-0400	1.735136924	2.030363275
2024-03-21T15:05:00.000-0400	1.753416379	1.682836294
2024-03-21T15:06:00.000-0400	1.792363893	1.862924138
2024-03-21T15:07:00.000-0400	5.003060737	2.801886629

[ITWhisperer]

If you want to use fieldformat, that's fine, but you still need to use the foreach command as I suggested

index=MyPCF
| fields server_instance cpu_percentage
| timechart mAX(cpu_percentage) as CPU_Percentage by server_instance usenull=true limit=0
| foreach * [| fieldformat "<<FILED>>"=round('<<FIELD>>',2)."%"]

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Foreach

[Sureshp191]

Thanks I tried both eval as well as fieldformat , still not getting the % appended. 

[ITWhisperer]

Please share the searches which are failing

[Sureshp191]

I tried both

index=MyPCF
| fields server instance cpu_percentage
| eval cpu_percentage=round(cpu_percentage,2)
| eval server_instance = 'server' + "_" + 'instance'
| timechart mAX(cpu_percentage) as CPU_Percentage by server_instance usenull=true limit=0
| foreach * [| fieldformat "<<FILED>>"=cpu_percentage  . "%"]

And

index=MyPCF
| fields server instance cpu_percentage
| eval cpu_percentage=round(cpu_percentage,2)
| eval server_instance = 'server' + "_" + 'instance'
| timechart mAX(cpu_percentage) as CPU_Percentage by server_instance usenull=true limit=0
| foreach * [| eval "<<FILED>>"=cpu_percentage  ."%"]

below is the output I get:

_time	Server_1	Server_2	Server_3
2024-03-25T14:00:00.000-0400	5.14	1.98	3.83
2024-03-25T14:01:00.000-0400	2.93	1.64	3.65
2024-03-25T14:02:00.000-0400	3.33	2.28	3.31
2024-03-25T14:03:00.000-0400	3.54	2.11	3.67
2024-03-25T14:04:00.000-0400	4.02	1.94	3.81
2024-03-25T14:05:00.000-0400	4.3	3.58	3.78
2024-03-25T14:06:00.000-0400	3.13	2.72	3.46
2024-03-25T14:07:00.000-0400	2.58	2.07	3.62
2024-03-25T14:08:00.000-0400	2.33	1.77	3.67
2024-03-25T14:09:00.000-0400	2.66	1.75	4.01
2024-03-25T14:10:00.000-0400	3.2	1.94	4.58
2024-03-25T14:11:00.000-0400	2.76	1.59	4.57

[PickleRick]

Don't replace the <<FIELD>> part on the right side of the eval in foreach with a static field name.

[Sureshp191]

Still the same, result whether its eval or fieldformat format, result is same.

index=MyPCF
| fields server instance cpu_percentage
| eval cpu_percentage=round(cpu_percentage,2)
| eval server_instance = 'server' + "_" + 'instance'
| timechart mAX(cpu_percentage) as CPU_Percentage by server_instance usenull=true limit=0
| foreach * [| eval "<<FILED>>"=round('<<FIELD>>',2)."%"]

Then changed to the following and tried, same result

| foreach * [| eval "<<FILED>>"= "<<FIELD>>" ."%"]

| foreach * [| eval "<<FILED>>"= '<<FIELD>>' ."%"]

| foreach * [| eval "<<FILED>>"= <<FIELD>> ."%"]

_time	server_1	server_2	server_3	server_4
2024-03-25T16:00:00.000-0400	5.18	3	4.62	3.18
2024-03-25T16:05:00.000-0400	5.46	3.13	3.99	2.94
2024-03-25T16:10:00.000-0400	5.55	54.16	3.93	51.89
2024-03-25T16:15:00.000-0400	4.76	4.59	4.4	2.84
2024-03-25T16:20:00.000-0400	5.54	3.84	4.55	2.95
2024-03-25T16:25:00.000-0400	4.11	3.76	3.52	3.31
2024-03-25T16:30:00.000-0400	4.36	3.92	3.58	2.91
2024-03-25T16:35:00.000-0400	3.88	3.68	3.7	4.08
2024-03-25T16:40:00.000-0400	3.89	3.32	4.33	3.32
2024-03-25T16:45:00.000-0400	4.33	27.56	3.94	39.48