Splunk Search

If function returning integers?

jordanb93
Explorer

This code snippet is being used to calculate a time into a normal time in the H.M format. The numbers are something like 1.93 which means 1 hour and 93 minutes. I'm trying to convert this into 2.33 so it is more easily read/understood.

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x4=(x2/100)
| eval x3 = if(x4>=(0.60),((x4/.6)+x1),(x4+x1))

Unfortunately anytime the substring x4 is greater than .60 it returns a whole number 2 or 3 only.

Anyone have any ideas as too why it is doing this?

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=((x3/0.6)+x1)
| eval x6=(x3+x1)
| eval x4=if(x3>=.6,x5,x6)

Edit: I spread out the code to troubleshoot it and the error lies in '| eval x5=((x3/0.6)+x1)'
It seems to be rounding the number to a whole number if it is over '2'. I don't know the reason why though.

0 Karma
1 Solution

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

View solution in original post

0 Karma

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

0 Karma

jordanb93
Explorer

Although this solves the integer issue the time is now off. Still searching for solution that returns the correct time.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...