Splunk Search

How to round a number to hundreds or thousands?

Motivator

HI,

I want to create tables that are easier to read and round the numbers to hundreds or thousands. Like

22113 -> 22100 or
22113 -> 22000

How can I achieve this?

Thanks in advance
Heinz

0 Karma
1 Solution

Motivator

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

View solution in original post

Motivator

try this

| makeresults | eval number=22113 | eval number=sigfig(1.00*number)

Result is

_time number

2017-07-05 11:19:58 22100

View solution in original post

Path Finder

Great!!! 👍

0 Karma

SplunkTrust
SplunkTrust

Is there a restriction to prefixing or suffixing the number with padded 0s?
Following examples will pad leading zeros and retain original number

Using printf (Splunk 6.6 onwards)

| makeresults
| eval number= 581
| fieldformat number=printf("%04d",number)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Motivator

Thanks, we are still on 6.5, so I'm currently not able to try it out

0 Karma

Builder

You can use eval and do it this way -
To 100s -

| makeresults | eval number=22113 | eval number=number-(number%100)

To 1000s -

| makeresults | eval number=22113 | eval number=number-(number%1000)
0 Karma

Motivator

Thanks for your reply.

| makeresults | eval number=22913 | eval number=number-(number%1000)

The above will end up with 22000 instead of 23000, so its more cutting that rounding. Is there a way to fix this?

0 Karma