Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Can I use modulus in Splunk to extract the dec...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nittalasub

Explorer

08-12-2017
03:40 PM

1 Solution

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

Legend

08-13-2017
01:40 PM

@niketnilay - Great demo, but modulo arithmetic does simplify the calculation down to ..

```
... | eval decimal=(7%2)/2
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

Legend

08-13-2017
01:40 PM

@niketnilay - Great demo, but modulo arithmetic does simplify the calculation down to ..

```
... | eval decimal=(7%2)/2
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nittalasub

Explorer

08-13-2017
10:12 PM

@Daljeanis -- thank you so much ! 🙂 that helped me to extract decimals from floating point numbers.

special thanks to Nike !

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

niketn

Legend

08-13-2017
10:49 PM

@nittalasub, I have converted @DalJeanis' comment to answer. Please accept to mark this question as answered. Kindly also up vote other comments that helped.

____________________________________________

| makeresults | eval message= "Happy Splunking!!!"

| makeresults | eval message= "Happy Splunking!!!"

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

niketn

Legend

08-13-2017
07:40 PM

@DalJeanis, I need to take not just Splunk lessons from you but maths also 🙂

How about dividend < divisor? like (3/7)?

____________________________________________

| makeresults | eval message= "Happy Splunking!!!"

| makeresults | eval message= "Happy Splunking!!!"

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

Legend

08-13-2017
08:19 PM

```
3%7 is 3, so (3%7)/7 = 3/7
```

The formula only fails (potentially)for negative numbers.

Depending on implementation -3%7 can be considered to be either -3 or +4. Those two numbers are identities in mod 7 ring theory and whatever the other relevant branches of discrete math are.... but not when you are calculating real world stuff.

So, for safety, if I couldn't run a quick test, I'd end up coding that as...

```
decimal=round(if(X<0, -(-X%Y)/Y,(X%Y)/Y),somenumber)
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

niketn

Legend

08-12-2017
10:18 PM

Following is the run anywhere search. While modular division is possible, you are actually looking just to extract decimal places.

```
| makeresults
| eval dividend=7
| eval divisor=2
| eval value=dividend/divisor
| eval remainder=dividend%divisor
| eval quotient=replace(value,"(\d+).(\d+)","\1")
| eval decimal=replace(value,"(\d+)(\.\d+)","0\2")
| table dividend divisor value remainder quotient decimal
```

Following are the results:

```
dividend divisor value remainder quotient decimal
7 2 3.5 1 3 0.5
```

____________________________________________

| makeresults | eval message= "Happy Splunking!!!"

| makeresults | eval message= "Happy Splunking!!!"

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust

08-12-2017
04:04 PM

Splunk does support the modulus (%) operator.

---

If this reply helps you, Karma would be appreciated.

If this reply helps you, Karma would be appreciated.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

jkat54

SplunkTrust

08-12-2017
08:08 PM

So it would look like this?

```
... | eval remainder=7%2
```

Correct? I've never done it before.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

Legend

08-13-2017
01:38 PM

@jkat54 - correct, but one more step to get the requested answer...

```
... | eval decimal=(7%2)/2
```

Get Updates on the Splunk Community!

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

October 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this ...

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...