Splunk Search

How to run round on multiple values?

danielbb
Motivator

The following works on one value - | eval devicedowntime2 = round(devicedowntime,4) but not on two or more.

Is there a way to make it work on multiple values?

0 Karma

HiroshiSatoh
Champion

Try this!

(your search)
| streamstats count as key
| mvexpand devicedowntime
| eval devicedowntime2=round(devicedowntime,4)
| stats list(devicedowntime) as devicedowntime,list(devicedowntime2) as devicedowntime2,latest(*) as * by key,_time
| fields - key

mayurr98
Super Champion

what do you mean by multiple values?
do you mean multiple fields?

you could use foreach command.

|  foreach <fields names>
    [eval <<FIELD>>=round('<<FIELD>>',4)]

OR if you want to give different names then try this :

|  foreach <fields names>
     [eval <<FIELD>>2=round('<<FIELD>>',4)]

Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Foreach#2._Monitor_license_usage

danielbb
Motivator

Sorry, I mean that the field I have, has multiple values.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...