Splunk Search

How to take precision of decimal point for a particular field?

microsac
Explorer

Hello experts,

I Just want my field `snow_os_version`  to be up to 2 decimal points like the first entry should only be  `3.10`, How to achieve that.

microsac_0-1648557195397.png

 

Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @microsac,

it depends on the valuer in SNOW, if you're sure that the format is always "nn.nn", you could use a regex like this:

| rex field=snow_os_version "^(?<snow_os_version>\d+\.(\d|(\d\d)))"

Ciao.

Giuseppe

View solution in original post

microsac
Explorer

Hi @gcusello ..

I tried something similar  rex field=snow_os_version "(?<os_version>\d+\.\d{1})"  but it only upto 1 decimal number like `3.1` i need it to take like `3.10`

0 Karma

somesoni2
Revered Legend

Try like this

Your current search
| eval snow_os_version=replace(snow_os_version,"^(\d+\.\d+).*","\1")

gcusello
SplunkTrust
SplunkTrust

Hi @microsac,

it depends on the valuer in SNOW, if you're sure that the format is always "nn.nn", you could use a regex like this:

| rex field=snow_os_version "^(?<snow_os_version>\d+\.(\d|(\d\d)))"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...