Splunk Search

How to round a number to hundreds or thousands?

HeinzWaescher
Motivator

HI,

I want to create tables that are easier to read and round the numbers to hundreds or thousands. Like

22113 -> 22100 or
22113 -> 22000

How can I achieve this?

Thanks in advance
Heinz

0 Karma
1 Solution

sbbadri
Motivator

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

View solution in original post

sbbadri
Motivator

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

verbal_666
Contributor

Great!!! 👍

0 Karma

Is there a restriction to prefixing or suffixing the number with padded 0s?
Following examples will pad leading zeros and retain original number

Using printf (Splunk 6.6 onwards)

| makeresults
| eval number= 581
| fieldformat number=printf("%04d",number)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

HeinzWaescher
Motivator

Thanks, we are still on 6.5, so I'm currently not able to try it out

0 Karma

dineshraj9
Builder

You can use eval and do it this way -
To 100s -

| makeresults | eval number=22113 | eval number=number-(number%100)

To 1000s -

| makeresults | eval number=22113 | eval number=number-(number%1000)
0 Karma

HeinzWaescher
Motivator

Thanks for your reply.

| makeresults | eval number=22913 | eval number=number-(number%1000)

The above will end up with 22000 instead of 23000, so its more cutting that rounding. Is there a way to fix this?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...