HI,
I want to create tables that are easier to read and round the numbers to hundreds or thousands. Like
22113 -> 22100 or
22113 -> 22000
How can I achieve this?
Thanks in advance
Heinz
try this
| makeresults | eval number=22113 | eval number=sigfig(1.00*number)
Result is
_time number
2017-07-05 11:19:58 22100
try this
| makeresults | eval number=22113 | eval number=sigfig(1.00*number)
Result is
_time number
2017-07-05 11:19:58 22100
Great!!! 👍
Is there a restriction to prefixing or suffixing the number with padded 0s?
Following examples will pad leading zeros and retain original number
Using printf (Splunk 6.6 onwards)
| makeresults
| eval number= 581
| fieldformat number=printf("%04d",number)
Thanks, we are still on 6.5, so I'm currently not able to try it out
You can use eval and do it this way -
To 100s -
| makeresults | eval number=22113 | eval number=number-(number%100)
To 1000s -
| makeresults | eval number=22113 | eval number=number-(number%1000)
Thanks for your reply.
| makeresults | eval number=22913 | eval number=number-(number%1000)
The above will end up with 22000 instead of 23000, so its more cutting that rounding. Is there a way to fix this?