Splunk Search

How to round the values before decimal or upto 2 decimal points?

microsac
Explorer
Hello experts,

How to round up the values either before decimal point or up to max two decimal point.

Below is my search query:

| mstats avg(_value) prestats=true WHERE metric_name="memory.used" AND "index"="*" AND 
(
"host"="fsx2098" OR
"host"="fsx2099" OR
"host"="fsx0102" OR
"host"="fsx0319" OR
"host"="fsxtp072"
) AND `sai_metrics_indexes` span=auto BY host
| timechart avg(_value) useother=false BY host WHERE max in top20
| fields - _span*

Below is Result of above:

microsac_0-1648575164293.png


Desired Value:

time                                                 host 1              host2              host3                host4

2022-03-29 13:20:00             26                       33                     34                     32
2022-03-29 13:21:00             27                       34                    34                    34

OR


time                                                 host 1              host2              host3                host4

2022-03-29 13:20:00             26.80                33.96             34.25                 32.93


Any help will be much appreciated.

 

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

| mstats avg(_value) prestats=true WHERE metric_name="memory.used" AND "index"="*" AND 
(
"host"="fsx2098" OR 
"host"="fsx2099" OR 
"host"="fsx0102" OR 
"host"="fsx0319" OR 
"host"="fsxtp072"
) AND `sai_metrics_indexes` span=auto BY host
| timechart avg(_value) useother=false BY host WHERE max in top20
| fields - _span*
| foreach * [| eval "<<FIELD>>"=round('<<FIELD>>',2) ]

Change the round function parameter based on how much precision you want. (ignore the parameter for no decimal point)

View solution in original post

somesoni2
Revered Legend

Try like this

| mstats avg(_value) prestats=true WHERE metric_name="memory.used" AND "index"="*" AND 
(
"host"="fsx2098" OR 
"host"="fsx2099" OR 
"host"="fsx0102" OR 
"host"="fsx0319" OR 
"host"="fsxtp072"
) AND `sai_metrics_indexes` span=auto BY host
| timechart avg(_value) useother=false BY host WHERE max in top20
| fields - _span*
| foreach * [| eval "<<FIELD>>"=round('<<FIELD>>',2) ]

Change the round function parameter based on how much precision you want. (ignore the parameter for no decimal point)

microsac
Explorer

Is there anything which we can only get values before decimal,   another point if there is a better way to put the multiple host into a bucket rather calling then with multiple "OR" conditions.

Sorry for asking too much.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...