Splunk Search

How to round decimal values up to 2 digits after the decimal in a Splunk search?

Path Finder

I am using below query :

`linux-cpu` | search application=pc4_BizX host=* sub_module=* | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | rename sub_module AS "Sub Module" pctLoad AS "CPU %"

Getting results like below:

Sub Module   CPU %    pctUser    pctSystem   pctNice    pctIowait
pc4_BizX    87.290618   0.000000   1.068261    0.439008   0.000000
pc4_BizX_A   95.066103   0.054263   0.026636    0.544853   0.000155
pc4_BizX_W   98.705398   0.000000   0.019912    0.544605   0.000000 

How do I round up to 2 digits after the decimal? Here I am getting 6 digits after the decimal.

Tags (3)
1 Solution

Communicator

You can use the eval command
linux-cpu | search application=pc4BizX host= submodule= | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by submodule | eval submodule=round(submodule,2) |eval pctLoad=round(pctLoad,2) | rename submodule AS "Sub Module" pctLoad AS "CPU %"

Reference:
http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Eval

View solution in original post

Communicator

You can use the eval command
linux-cpu | search application=pc4BizX host= submodule= | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by submodule | eval submodule=round(submodule,2) |eval pctLoad=round(pctLoad,2) | rename submodule AS "Sub Module" pctLoad AS "CPU %"

Reference:
http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Eval

View solution in original post

Path Finder

Thanks it worked !!!

0 Karma