Problems with rounding

[rgcox1]

Having difficulty with simple rounding.

 index=_internal  group=per_sourcetype_thruput | eval gb=round(kb/1048576, 2)| stats sum(gb) sum(kb) by series |sort -sum(gb) 

Incorrect GB in result:
series                      sum(gb)                sum(kb)
wineventlog:security 1.66                      4727905.487416

index=_internal  group=per_sourcetype_thruput | eval gb=kb/1048576| stats sum(gb) sum(kb) by series |sort -sum(gb) 

Correct GB in result without rounding:
series                      sum(gb)                sum(kb)
wineventlog:security 4.5088820335775   4727905.487416

Have tried various versions of the base formula:
gb=round(kb/104856)
gb=round((kb/1024/1024), 2)
gb=round(((kb/1024)/1024), 2)
gb=round(kb/1024/1024)

But nothing works. What am I doing wrong?

[ashishganger]

I think you need to sum the data in KB by Host rather than series. Each host has multiple sources and source types. It would be better to monitor the data throughput per host then series. Use the below search query:

index=_internal group=per_sourcetype_thruput | stats sum(kb) as DataKB, avg(kbps) as AVG-KBPS by host | eval DataGB=round(DataKB/1048576,2) | sort DataGB

[ashishganger]

Also mind that there should be no space while using the round function 🙂

[assaftoval]

The solution above it not working..

[gkanapathy · Accepted solution]

If you round before summing up the values, you round off most of it before you can actually add it up. Most of the kb values are small. If you divide any number less than 10,000 by 1,000,000 (or 1,048,576) and round to 2 places, it comes out to zero, so you end up adding up a whole bunch of zeros.

The solution is to round after you sum, e.g.:

index=_internal group=per_sourcetype_thruput
| stats sum(kb) as sum_kb by series
| eval sum_gb=round(sum_kb/1048576,2)

[rishiaggarwal]

I downvoted this post because solution is not working