Splunk Search

How to get higher up value for the columns in my chart when ceil isn't working?

Vish
Explorer

In the below chart if u can see i have used round and avg to first_response and closure time.

But my values are not accurate, i want the values like if its 1.3 or 1.9  also it should display 2 but mine is shown as 1.3 is 1 and 1.9 is 2.

But to perform the above function ceil isnt working what to do ?

Vish_0-1683611922322.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ceil() doesn't work as part of an aggregation but you can perform it afterwards.

| chart avg(FIRST_RESPONSE) as FIRST_RESPONSE avg(CLOSURE_TIME) as CLOSURE_TIME over MONTH
| eval FIRST_RESPONSE = ceil(FIRST_RESPONSE)
| eval CLOSURE_TIME = ceil(CLOSURE_TIME)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

ceil() doesn't work as part of an aggregation but you can perform it afterwards.

| chart avg(FIRST_RESPONSE) as FIRST_RESPONSE avg(CLOSURE_TIME) as CLOSURE_TIME over MONTH
| eval FIRST_RESPONSE = ceil(FIRST_RESPONSE)
| eval CLOSURE_TIME = ceil(CLOSURE_TIME)
0 Karma

Vish
Explorer

Thanks alot it worked

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You mean |chart eval(round(avg(FIRST_RESPONSE), 1)) as FIRST_RESPONSE?

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @Vish 

to get decimal values please use 2 instead of 0 in round function  

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...