Splunk Search

## How to round decimal values up to 2 digits after the decimal in a Splunk search?

Path Finder

I am using below query :

```````linux-cpu` | search application=pc4_BizX host=* sub_module=* | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | rename sub_module AS "Sub Module" pctLoad AS "CPU %"
``````

Getting results like below:

``````Sub Module   CPU %    pctUser    pctSystem   pctNice    pctIowait
pc4_BizX    87.290618   0.000000   1.068261    0.439008   0.000000
pc4_BizX_A   95.066103   0.054263   0.026636    0.544853   0.000155
pc4_BizX_W   98.705398   0.000000   0.019912    0.544605   0.000000
``````

How do I round up to 2 digits after the decimal? Here I am getting 6 digits after the decimal.

Tags (3)
1 Solution
Communicator

You can use the eval command
linux-cpu | search application=pc4_BizX host= sub_module= | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | eval sub_module=round(sub_module,2) |eval pctLoad=round(pctLoad,2) | rename sub_module AS "Sub Module" pctLoad AS "CPU %"

Communicator

You can use the eval command
linux-cpu | search application=pc4_BizX host= sub_module= | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | eval sub_module=round(sub_module,2) |eval pctLoad=round(pctLoad,2) | rename sub_module AS "Sub Module" pctLoad AS "CPU %"

Path Finder

Thanks it worked !!!

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!