Splunk Search

If function returning integers?

jordanb93
Explorer

This code snippet is being used to calculate a time into a normal time in the H.M format. The numbers are something like 1.93 which means 1 hour and 93 minutes. I'm trying to convert this into 2.33 so it is more easily read/understood.

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x4=(x2/100)
| eval x3 = if(x4>=(0.60),((x4/.6)+x1),(x4+x1))

Unfortunately anytime the substring x4 is greater than .60 it returns a whole number 2 or 3 only.

Anyone have any ideas as too why it is doing this?

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=((x3/0.6)+x1)
| eval x6=(x3+x1)
| eval x4=if(x3>=.6,x5,x6)

Edit: I spread out the code to troubleshoot it and the error lies in '| eval x5=((x3/0.6)+x1)'
It seems to be rounding the number to a whole number if it is over '2'. I don't know the reason why though.

0 Karma
1 Solution

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

View solution in original post

0 Karma

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

0 Karma

jordanb93
Explorer

Although this solves the integer issue the time is now off. Still searching for solution that returns the correct time.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...