Is there a way to round up the average, max and min values to 2 decimal places - without disrupting the sparkline display format?
Here is my SPL :
....| transaction maxspan=4h counter by host | stats sparkline(avg(Value),30m) AS Trend_Processor_time avg(Value) AS AVG min(Value) AS MIN max(Value) AS MAX by host
You could use an eval
statement to and the round
function to accomplish this. For example, you can try this search:
index="_internal" sourcetype=splunkd eps="*"
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group
| eval AVG=round(AVG,2)
| eval MIN=round(MIN,2)
| eval MAX=round(MAX,2)
--
This will produce the following:
What you cannot do is reassign the value of the trend_eps
results after the stats
statement.
The eval functions are documented here.
You could use an eval
statement to and the round
function to accomplish this. For example, you can try this search:
index="_internal" sourcetype=splunkd eps="*"
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group
| eval AVG=round(AVG,2)
| eval MIN=round(MIN,2)
| eval MAX=round(MAX,2)
--
This will produce the following:
What you cannot do is reassign the value of the trend_eps
results after the stats
statement.
The eval functions are documented here.
Nice!! Thanks for the feedback.