Splunk Search

If function returning integers?

jordanb93
Explorer

This code snippet is being used to calculate a time into a normal time in the H.M format. The numbers are something like 1.93 which means 1 hour and 93 minutes. I'm trying to convert this into 2.33 so it is more easily read/understood.

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x4=(x2/100)
| eval x3 = if(x4>=(0.60),((x4/.6)+x1),(x4+x1))

Unfortunately anytime the substring x4 is greater than .60 it returns a whole number 2 or 3 only.

Anyone have any ideas as too why it is doing this?

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=((x3/0.6)+x1)
| eval x6=(x3+x1)
| eval x4=if(x3>=.6,x5,x6)

Edit: I spread out the code to troubleshoot it and the error lies in '| eval x5=((x3/0.6)+x1)'
It seems to be rounding the number to a whole number if it is over '2'. I don't know the reason why though.

0 Karma
1 Solution

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

View solution in original post

0 Karma

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

0 Karma

jordanb93
Explorer

Although this solves the integer issue the time is now off. Still searching for solution that returns the correct time.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...