Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Can I use modulus in Splunk to extract the dec...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nittalasub

Explorer

08-12-2017
03:40 PM

1 Solution

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

SplunkTrust

08-13-2017
01:40 PM

@niketnilay - Great demo, but modulo arithmetic does simplify the calculation down to ..

```
... | eval decimal=(7%2)/2
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

SplunkTrust

08-13-2017
01:40 PM

@niketnilay - Great demo, but modulo arithmetic does simplify the calculation down to ..

```
... | eval decimal=(7%2)/2
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nittalasub

Explorer

08-13-2017
10:12 PM

@Daljeanis -- thank you so much ! 🙂 that helped me to extract decimals from floating point numbers.

special thanks to Nike !

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

niketn

Legend

08-13-2017
10:49 PM

@nittalasub, I have converted @DalJeanis' comment to answer. Please accept to mark this question as answered. Kindly also up vote other comments that helped.

____________________________________________

| makeresults | eval message= "Happy Splunking!!!"

| makeresults | eval message= "Happy Splunking!!!"

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

niketn

Legend

08-13-2017
07:40 PM

@DalJeanis, I need to take not just Splunk lessons from you but maths also 🙂

How about dividend < divisor? like (3/7)?

____________________________________________

| makeresults | eval message= "Happy Splunking!!!"

| makeresults | eval message= "Happy Splunking!!!"

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

SplunkTrust

08-13-2017
08:19 PM

```
3%7 is 3, so (3%7)/7 = 3/7
```

The formula only fails (potentially)for negative numbers.

Depending on implementation -3%7 can be considered to be either -3 or +4. Those two numbers are identities in mod 7 ring theory and whatever the other relevant branches of discrete math are.... but not when you are calculating real world stuff.

So, for safety, if I couldn't run a quick test, I'd end up coding that as...

```
decimal=round(if(X<0, -(-X%Y)/Y,(X%Y)/Y),somenumber)
```

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

niketn

Legend

08-12-2017
10:18 PM

Following is the run anywhere search. While modular division is possible, you are actually looking just to extract decimal places.

```
| makeresults
| eval dividend=7
| eval divisor=2
| eval value=dividend/divisor
| eval remainder=dividend%divisor
| eval quotient=replace(value,"(\d+).(\d+)","\1")
| eval decimal=replace(value,"(\d+)(\.\d+)","0\2")
| table dividend divisor value remainder quotient decimal
```

Following are the results:

```
dividend divisor value remainder quotient decimal
7 2 3.5 1 3 0.5
```

____________________________________________

| makeresults | eval message= "Happy Splunking!!!"

| makeresults | eval message= "Happy Splunking!!!"

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust

08-12-2017
04:04 PM

Splunk does support the modulus (%) operator.

---

If this reply helps you, Karma would be appreciated.

If this reply helps you, Karma would be appreciated.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

jkat54

SplunkTrust

08-12-2017
08:08 PM

So it would look like this?

```
... | eval remainder=7%2
```

Correct? I've never done it before.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DalJeanis

SplunkTrust

08-13-2017
01:38 PM

@jkat54 - correct, but one more step to get the requested answer...

```
... | eval decimal=(7%2)/2
```

Get Updates on the Splunk Community!

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Happy Pride Month, Splunk Community! 🌈
In the United States, as well as many countries around the ...

The Background
Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...