Hi Team,
I have a field like below :
Cost :
0.4565534553453
0.0000435463466
0.0021345667788
0.0000000005657
I want to get values from this cost field which has value till 4 decimals i.e only 0.4565534553453 and 0.0021345667788.
How can I achieve this in my splunk query. Please can anyone help me .
Regards,
NVP
| makeresults| eval Cost="0.4565534553453" | table Cost
| append [ | makeresults| eval Cost="0.0000435463466" | table Cost]
| append [| makeresults| eval Cost="0.0021345667788" | table Cost ]
| append [ | makeresults| eval Cost="0.0000000005657" | table Cost ]
| rex field=Cost "(?<Cost_New>\d+\.\d{4})" |where Cost_New > 0 |table Cost
Your example is inconsistent with your description.
Rounding a value to 4 decimal digits is one thing but your description suggests that you simply want to filter out values that not smaller than 0.0001
Try something like that:
| eval cost_rounded = round(Cost, 4)
| where cost_rounded > 0
| rex field=Cost "(?<truncated_cost>\d+\.\d{4})"