Splunk Search

How to get higher up value for the columns in my chart when ceil isn't working?

Vish
Explorer

In the below chart if u can see i have used round and avg to first_response and closure time.

But my values are not accurate, i want the values like if its 1.3 or 1.9  also it should display 2 but mine is shown as 1.3 is 1 and 1.9 is 2.

But to perform the above function ceil isnt working what to do ?

Vish_0-1683611922322.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ceil() doesn't work as part of an aggregation but you can perform it afterwards.

| chart avg(FIRST_RESPONSE) as FIRST_RESPONSE avg(CLOSURE_TIME) as CLOSURE_TIME over MONTH
| eval FIRST_RESPONSE = ceil(FIRST_RESPONSE)
| eval CLOSURE_TIME = ceil(CLOSURE_TIME)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

ceil() doesn't work as part of an aggregation but you can perform it afterwards.

| chart avg(FIRST_RESPONSE) as FIRST_RESPONSE avg(CLOSURE_TIME) as CLOSURE_TIME over MONTH
| eval FIRST_RESPONSE = ceil(FIRST_RESPONSE)
| eval CLOSURE_TIME = ceil(CLOSURE_TIME)
0 Karma

Vish
Explorer

Thanks alot it worked

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You mean |chart eval(round(avg(FIRST_RESPONSE), 1)) as FIRST_RESPONSE?

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @Vish 

to get decimal values please use 2 instead of 0 in round function  

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...