Splunk Search

How to run round on multiple values?

danielbb
Motivator

The following works on one value - | eval devicedowntime2 = round(devicedowntime,4) but not on two or more.

Is there a way to make it work on multiple values?

0 Karma

HiroshiSatoh
Champion

Try this!

(your search)
| streamstats count as key
| mvexpand devicedowntime
| eval devicedowntime2=round(devicedowntime,4)
| stats list(devicedowntime) as devicedowntime,list(devicedowntime2) as devicedowntime2,latest(*) as * by key,_time
| fields - key

mayurr98
Super Champion

what do you mean by multiple values?
do you mean multiple fields?

you could use foreach command.

|  foreach <fields names>
    [eval <<FIELD>>=round('<<FIELD>>',4)]

OR if you want to give different names then try this :

|  foreach <fields names>
     [eval <<FIELD>>2=round('<<FIELD>>',4)]

Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Foreach#2._Monitor_license_usage

danielbb
Motivator

Sorry, I mean that the field I have, has multiple values.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...