Dashboards & Visualizations

## round function not consistent

Engager

hi all,

am running into an inconsistency with simple round function depending on the decimal placing,
here's wat am getting

index=_internal type=usage
| eval totalGB = b/(1024*1024*1024)
| eval roundGB= round (totalGB,5)

one day value = 4.47213

when its

eval roundGB= round (totalGB,3)    -- i get 2.791

| eval roundGB= round (totalGB,2) -- i get 0.32

for the same day.

any idea what is happening here?

Labels (1)
• ### other

Tags (1)
1 Solution
SplunkTrust

If that is your search, then you are simply calculating the usage value in GB for each event you see - you are not calculating a total or doing any kind of aggregation on that data. When you say 'in the same day' you are not calculating a total for the day.

Are you really looking for something like this?

``````index=_internal type=usage
| bin _time span=1d
| stats sum(b) as b by _time
| eval totalGB = b/(1024*1024*1024)
| eval roundGB= round (totalGB,5)``````

which aggregates the total of the bytes value (b) and then calculates total in GB, by day? Or done in a different way using timechart

``````index=_internal type=usage
| timechart span=1d sum(b) as b
| eval totalGB = b/(1024*1024*1024)
| eval roundGB= round (totalGB,5)``````
SplunkTrust

If that is your search, then you are simply calculating the usage value in GB for each event you see - you are not calculating a total or doing any kind of aggregation on that data. When you say 'in the same day' you are not calculating a total for the day.

Are you really looking for something like this?

``````index=_internal type=usage
| bin _time span=1d
| stats sum(b) as b by _time
| eval totalGB = b/(1024*1024*1024)
| eval roundGB= round (totalGB,5)``````

which aggregates the total of the bytes value (b) and then calculates total in GB, by day? Or done in a different way using timechart

``````index=_internal type=usage
| timechart span=1d sum(b) as b
| eval totalGB = b/(1024*1024*1024)
| eval roundGB= round (totalGB,5)``````
Engager

thx a lot @bowesmana
yes actually that's what am after, i didn't mention part in my question (don't know y), but yea, that helps a lot.

my mistake is that i was rounding in gigs before the sum, and since the original values of b are in bytes so rounding the gig value with 2 decimal places was zero for almost all of the events.

lesson learned, no rounding before sum (especially with smaller values)

SplunkTrust

@ramy19 Shouldn't be such big different for rounding 2,3 and 5. As you see they are consistent. It all depends on how your totalGB looks like that might be varying between rounding 2,3 and 5.

See how is your totalGB looks like as below,

---

Get Updates on the Splunk Community!

#### Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

#### Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

#### We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...