Splunk Search

## How to round up a field value which contains the digits?

Builder

I have a search which displays the average_time_spent in the format "hh:mm:ss"

my search | eval field_in_hhmmss=tostring(avgDurationPerpid, "duration") | table id field_in_hhmmss

which displays as below

id field_in_hhmmss

23 01:58:36.344000

Now how can i round up the seconds part in an understandable way like instead of 01:58:36.344000 it should display as 01:58:37?

Tags (3)
1 Solution
Motivator

It depends on what function do you want to use to round of : `floor`, `ceil` etc. and then rounding off before you convert via `tostring`. Something like this:

``````my search
|eval field_in_hhmmss=tostring(ceil(avgDurationPerpid), "duration")
| table id field_in_hhmmss
``````

OR

``````my search
|eval field_in_hhmmss=tostring(floor(avgDurationPerpid), "duration")
| table id field_in_hhmmss
``````
Motivator

It depends on what function do you want to use to round of : `floor`, `ceil` etc. and then rounding off before you convert via `tostring`. Something like this:

``````my search
|eval field_in_hhmmss=tostring(ceil(avgDurationPerpid), "duration")
| table id field_in_hhmmss
``````

OR

``````my search
|eval field_in_hhmmss=tostring(floor(avgDurationPerpid), "duration")
| table id field_in_hhmmss
``````
Builder

I would think using ceil would be the best in my case. So how can I make the users to display in descending order based on the fields_in_hhmmss

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!