Splunk Search

How to round values to 2 decimal places, but only for values with non zeros?

splunker9999
Path Finder

Hi,

We have a search which gives us availability of our platforms. We used the syntax below to round for 2 decimal places.

| stats avg(Value) as Average|eval Average=round((Average*100),2)|eval range=if(Average >=0, "low", "severe")

This is giving us results like below

Average
100.00
99.99

Now we want to round off only for values which have non zero in decimal places. Can we do this?
Output should show like this below.

Average
100
99.99
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

| stats avg(Value) as Average|eval Average=round((Average*100),2) | eval Average=if(floor(Average)=Average,floor(Average),Average) |eval range=if(Average >=0, "low", "severe")
0 Karma

splunker9999
Path Finder

In statistics it is displaying as correct value, but in single value panel it is rounding to the nearest value.

If result is as 99.99 , it is rounding to 100 in single value panel?

Also can you please advice how can we append Pecentage to value in single value panel?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The single value visualization has default numberPrecision as 0, so it'll round off while displaying. You could either edit the visualization to increase this precision to 2 digits, but it may temper with full numbers then.

I think below query will resolve both your issues, rounding off and adding % sign

| stats avg(Value) as Average|eval Average=round((Average*100),2) | eval Average=if(floor(Average)=Average,floor(Average),Average) |eval range=if(Average >=0, "low", "severe") | eval Average=Average." %"
0 Karma

pgrantham_splun
Splunk Employee
Splunk Employee

Another easy way you could do it is using a modulo operation:

| eval Average = if(Average%1>0,round(Average*100,2),Average*100) 

Edit: Added the *100 so you can get what I believe is the desired result in one eval.

0 Karma

beatus
Communicator

Splunker9999,

You could combo it up with an if statement in your eval:

|eval Average=round((Average*100),2) |eval Average = if(match(Average, "\.[0]+$"),  round((Average),0), round((Average),2) )

There may be a way to combine it up into one eval, but i'm blanking on it.

0 Karma

splunker9999
Path Finder

In statistics it is displaying as correct value, but in single value panel it is rounding to the nearest value.

If result is as 99.99 , it is rounding to 100 in single value panel?

Also can you please advice how can we append Pecentage to value in single value panel?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...