Splunk Search

Is it possible to round up average, max, and min values to 2 decimal places using eval, but without changing how a sparkline is displayed?

bidahor13
Path Finder

Is there a way to round up the average, max and min values to 2 decimal places - without disrupting the sparkline display format?

Here is my SPL :

....| transaction maxspan=4h counter  by host | stats  sparkline(avg(Value),30m) AS Trend_Processor_time avg(Value) AS AVG  min(Value) AS MIN  max(Value) AS MAX by host
0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

alt text

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

View solution in original post

Gilberto_Castil
Splunk Employee
Splunk Employee

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

alt text

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

View solution in original post

bidahor13
Path Finder

Nice!! Thanks for the feedback.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.