Splunk Search

How to shorten the numeric values for a field to only 2 decimals?

SecurityIsMyMid
Explorer

Here is my search fields + host,lastTime,dayDiff | eval c_time=strftime(log_time,"%m/%d/%y %H:%M:%S")
I'm trying to shorten daydiff to only 2 decimals. I've tried all the other answers and nothing seems to work.

0 Karma

sundareshr
Legend

Like this eval daydiff=round(daydiff, 2) before you do the strftime

SecurityIsMyMid
Explorer

My whole search is:

| `host_eventcount(30,2)` | search is_expected=true | `ctime(lastTime)`  | fields + host,lastTime,dayDiff  |rename host AS "Hostname", lastTime AS "Last Time Seen" , dayDiff AS "Days Not Seen" | eval c_time=strftime(log_time,"%m/%d/%y %H:%M:%S") 

Anyway to make this more efficient?

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...