Splunk Search

How to round up a number and avoid infinite zeros?

adonio
Ultra Champion

I am trying to round UP numbers one decimal to the left whenever its, for example:
10510 ---> 11000
10499 ---> 10000
read the following answers, but cant apply those as they are rounding down, also, seems like the ciel function is depreciated?
https://answers.splunk.com/answers/475056/how-to-round-up-a-field-value-which-contains-the-d.html
https://answers.splunk.com/answers/552707/how-to-round-a-number-to-hundreds-or-thousands.html
here is my search: WARNING! it might break your web browser:

| makeresults count=1
| eval data = "10510,20010.11,10999.99,10500,10499,10000,10001,501,21"
| makemv delim="," data
| mvexpand data
| eval rounded_1 = round(data, -1)
| eval rounded_2 = round(data, -2)
| eval rounded_3 = round(data, -3)
| eval using_floor = floor(data)

How can I avoid the zeros? see screenshot:
alt text

0 Karma
1 Solution

somesoni2
Revered Legend

The ceil or ceiling function but now we just have ceiling.

Your rounding_3 didn't work for me in Splunk 6.2x. I thought function sigfig would work but that also doesn't work past 2 decimal digits. I found the expression (workaround) I used in rounding_custom worked for me. Give this a try.

| gentimes start=-1 
 | eval data = "10550,20010.11,10999.99,10500,10499,10000,10001,501,21" | table data
 | makemv delim="," data
 | mvexpand data
 | eval rounded_1 = round(data, -1)
 | eval rounded_2 = round(data, -2)
 | eval rounding_sigfig = sigfig(data*1.000) 
| eval rounding_custom=round(data/1000)*1000
| eval using_floor = ceil(data)

View solution in original post

somesoni2
Revered Legend

The ceil or ceiling function but now we just have ceiling.

Your rounding_3 didn't work for me in Splunk 6.2x. I thought function sigfig would work but that also doesn't work past 2 decimal digits. I found the expression (workaround) I used in rounding_custom worked for me. Give this a try.

| gentimes start=-1 
 | eval data = "10550,20010.11,10999.99,10500,10499,10000,10001,501,21" | table data
 | makemv delim="," data
 | mvexpand data
 | eval rounded_1 = round(data, -1)
 | eval rounded_2 = round(data, -2)
 | eval rounding_sigfig = sigfig(data*1.000) 
| eval rounding_custom=round(data/1000)*1000
| eval using_floor = ceil(data)

adonio
Ultra Champion

thanks @somesoni!
up voting as i find this round(data/1000)*1000 very useful.
however, if have a 6 (or greater) digits number, the rounding_custom wont work and seems like ill have to adjust the rounding_custom rule accordingly.
thanks again

0 Karma

somesoni2
Revered Legend

Do you've example data for those 6 or higher digit with expected output?

0 Karma

adonio
Ultra Champion

yes, can be anywhere as the value is sum of counts it can range form single digits to rare items all the way to 9 digits, the highest ive seen so far in this data set

0 Karma

somesoni2
Revered Legend

So you want to dynamically round based on 2nd digit from left. Give this a try (should work for any length of data)

| gentimes start=-1 
 | eval data = "123456,1234567,87654321,987654321,123456789,10510,20010.11,10999.99,10500,10499,10000,10001,501,552,21,29" | table data
 | makemv delim="," data
 | mvexpand data | eval mf=pow(10,len(tostring(round(data)))-1)
 | eval rounding_custom1=round(data/mf)*mf
0 Karma

adonio
Ultra Champion

@somesoni2, i see your trick there with the multiplying factor, love it.
ill take it as an answer as it works. still puzzled why the round(X, -3) wont work... any idea?
thanks again!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...