Splunk Search

How do I cut the designated decimal place based on numerical number?

syusjk6
Engager

Say, I have come up with the result value, 3.9999.

I want the rest of decimal places gone after the second decimal place as in 3.9999.
What would you suggest?

FYI, I don't want "round(3.9999, 2).'

Tags (1)
0 Karma

jonuwz
Influencer

you could use a regex

... | rex field=value (?<value>^-?\d+\.\d{2})\d+$

jonuwz
Influencer

syusjk6 - thank you for assigning me rep 🙂
The usual way is to click on the grey up arrow to the left of the answer if it helped you out. And if it answered your question completely, accept the answer.

0 Karma

cyue_splunk
Splunk Employee
Splunk Employee

I don't know if there is a command to directly provide result as you required. But I think you can do sth like this:

| eval value_new=round(floor(value_old*100)/100,2)

0 Karma

syusjk6
Engager

Thanks. This helped.

0 Karma

syusjk6
Engager

For example,
I want 3.9999 to be cut into 3.99, not into 4.00, or
I want 3.1634 to be cut into 3.16, not into 3.20.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!