Splunk Search

How to round up a field value which contains the digits?

pavanae
Builder

I have a search which displays the average_time_spent in the format "hh:mm:ss"

my search | eval field_in_hhmmss=tostring(avgDurationPerpid, "duration") | table id field_in_hhmmss

which displays as below

id field_in_hhmmss

23 01:58:36.344000

Now how can i round up the seconds part in an understandable way like instead of 01:58:36.344000 it should display as 01:58:37?

0 Karma
1 Solution

gokadroid
Motivator

It depends on what function do you want to use to round of : floor, ceil etc. and then rounding off before you convert via tostring. Something like this:

my search 
|eval field_in_hhmmss=tostring(ceil(avgDurationPerpid), "duration") 
| table id field_in_hhmmss

OR

my search 
|eval field_in_hhmmss=tostring(floor(avgDurationPerpid), "duration") 
| table id field_in_hhmmss

View solution in original post

0 Karma

gokadroid
Motivator

It depends on what function do you want to use to round of : floor, ceil etc. and then rounding off before you convert via tostring. Something like this:

my search 
|eval field_in_hhmmss=tostring(ceil(avgDurationPerpid), "duration") 
| table id field_in_hhmmss

OR

my search 
|eval field_in_hhmmss=tostring(floor(avgDurationPerpid), "duration") 
| table id field_in_hhmmss

View solution in original post

0 Karma

pavanae
Builder

I would think using ceil would be the best in my case. So how can I make the users to display in descending order based on the fields_in_hhmmss

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.