Splunk Search

How to round a number to hundreds or thousands?

HeinzWaescher
Motivator

HI,

I want to create tables that are easier to read and round the numbers to hundreds or thousands. Like

22113 -> 22100 or
22113 -> 22000

How can I achieve this?

Thanks in advance
Heinz

0 Karma
1 Solution

sbbadri
Motivator

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

View solution in original post

sbbadri
Motivator

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

verbal_666
Builder

Great!!! 👍

0 Karma

niketn
Legend

Is there a restriction to prefixing or suffixing the number with padded 0s?
Following examples will pad leading zeros and retain original number

Using printf (Splunk 6.6 onwards)

| makeresults
| eval number= 581
| fieldformat number=printf("%04d",number)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

HeinzWaescher
Motivator

Thanks, we are still on 6.5, so I'm currently not able to try it out

0 Karma

dineshraj9
Builder

You can use eval and do it this way -
To 100s -

| makeresults | eval number=22113 | eval number=number-(number%100)

To 1000s -

| makeresults | eval number=22113 | eval number=number-(number%1000)
0 Karma

HeinzWaescher
Motivator

Thanks for your reply.

| makeresults | eval number=22913 | eval number=number-(number%1000)

The above will end up with 22000 instead of 23000, so its more cutting that rounding. Is there a way to fix this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...