Splunk Search

How to Round an eval average

Explorer

How do I round these numbers with this search?

index=net_auth_long 
| eval time_hour=strftime(_time,"%H")
| chart eval(count(channel)/7) AS field_div_by_7 by channel time_hour

 

tefa627_0-1599857872883.png

 

Labels (1)
Tags (3)
0 Karma
1 Solution

Champion

| foreach * [ eval <<FIELD>> = round(<<FIELD>>,0)]

————————————
If this helps, give a like below.

View solution in original post

0 Karma

Champion

| foreach * [ eval <<FIELD>> = round(<<FIELD>>,0)]

————————————
If this helps, give a like below.

View solution in original post

0 Karma

Champion
Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like
| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’)]
0 Karma

Communicator

 

 

| chart eval(floor(count(channel)/7)) AS field_div_by_7 by channel time_hour

 

or

 

| chart eval(round(count(channel)/7, 0)) AS field_div_by_7 by channel time_hour

Sorry, bracket was in the wrong place - still not sure if it will work though

 

 

0 Karma

Explorer

Neither way worked..

tefa627_0-1599859283407.png

 

0 Karma