Splunk Search

How to Round an eval average

tefa627
Explorer

How do I round these numbers with this search?

index=net_auth_long 
| eval time_hour=strftime(_time,"%H")
| chart eval(count(channel)/7) AS field_div_by_7 by channel time_hour

 

tefa627_0-1599857872883.png

 

Labels (1)
Tags (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

| foreach * [ eval <<FIELD>> = round(<<FIELD>>,0)]

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

| foreach * [ eval <<FIELD>> = round(<<FIELD>>,0)]

————————————
If this helps, give a like below.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like
| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

 

| chart eval(floor(count(channel)/7)) AS field_div_by_7 by channel time_hour

 

or

 

| chart eval(round(count(channel)/7, 0)) AS field_div_by_7 by channel time_hour

Sorry, bracket was in the wrong place - still not sure if it will work though

 

 

0 Karma

tefa627
Explorer

Neither way worked..

tefa627_0-1599859283407.png

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...