The following works on one value - | eval devicedowntime2 = round(devicedowntime,4)
but not on two or more.
Is there a way to make it work on multiple values?
Try this!
(your search)
| streamstats count as key
| mvexpand devicedowntime
| eval devicedowntime2=round(devicedowntime,4)
| stats list(devicedowntime) as devicedowntime,list(devicedowntime2) as devicedowntime2,latest(*) as * by key,_time
| fields - key
what do you mean by multiple values?
do you mean multiple fields?
you could use foreach
command.
| foreach <fields names>
[eval <<FIELD>>=round('<<FIELD>>',4)]
OR if you want to give different names then try this :
| foreach <fields names>
[eval <<FIELD>>2=round('<<FIELD>>',4)]
Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Foreach#2._Monitor_license_usage
Sorry, I mean that the field I have, has multiple values.