Splunk Search

Is it possible to round up average, max, and min values to 2 decimal places using eval, but without changing how a sparkline is displayed?

Path Finder

Is there a way to round up the average, max and min values to 2 decimal places - without disrupting the sparkline display format?

Here is my SPL :

....| transaction maxspan=4h counter  by host | stats  sparkline(avg(Value),30m) AS Trend_Processor_time avg(Value) AS AVG  min(Value) AS MIN  max(Value) AS MAX by host
0 Karma
1 Solution

Splunk Employee
Splunk Employee

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

alt text

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

View solution in original post

Splunk Employee
Splunk Employee

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

alt text

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

View solution in original post

Path Finder

Nice!! Thanks for the feedback.

0 Karma