Splunk Search

Is it possible to round up average, max, and min values to 2 decimal places using eval, but without changing how a sparkline is displayed?

bidahor13
Path Finder

Is there a way to round up the average, max and min values to 2 decimal places - without disrupting the sparkline display format?

Here is my SPL :

....| transaction maxspan=4h counter  by host | stats  sparkline(avg(Value),30m) AS Trend_Processor_time avg(Value) AS AVG  min(Value) AS MIN  max(Value) AS MAX by host
0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

alt text

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

View solution in original post

Gilberto_Castil
Splunk Employee
Splunk Employee

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

alt text

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

bidahor13
Path Finder

Nice!! Thanks for the feedback.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...