Splunk Search

How to run round on multiple values?

Motivator

The following works on one value - | eval devicedowntime2 = round(devicedowntime,4) but not on two or more.

Is there a way to make it work on multiple values?

0 Karma

Champion

Try this!

(your search)
| streamstats count as key
| mvexpand devicedowntime
| eval devicedowntime2=round(devicedowntime,4)
| stats list(devicedowntime) as devicedowntime,list(devicedowntime2) as devicedowntime2,latest(*) as * by key,_time
| fields - key

SplunkTrust
SplunkTrust

what do you mean by multiple values?
do you mean multiple fields?

you could use foreach command.

|  foreach <fields names>
    [eval <<FIELD>>=round('<<FIELD>>',4)]

OR if you want to give different names then try this :

|  foreach <fields names>
     [eval <<FIELD>>2=round('<<FIELD>>',4)]

Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Foreach#2._Monitor_license_usage

Motivator

Sorry, I mean that the field I have, has multiple values.

0 Karma