Splunk Search

## Round down Engager

I have a function where I take a number, divide it by 3, then would like to round that number down. Is that possible to do in Splunk? Could I instead use something like split()?

Tags (1)
1 Solution Builder

Use eval's floor function.

``````
| eval foo=floor(Value/3)
``````

This gives you an integer, but if you really need to maintain some decimal places you could do some extra math, like eval foo=(floor(Value*100/3))/100 to get 2 places. Builder

Use eval's floor function.

``````
| eval foo=floor(Value/3)
``````

This gives you an integer, but if you really need to maintain some decimal places you could do some extra math, like eval foo=(floor(Value*100/3))/100 to get 2 places. Motivator

Try the round function:
As presented in the documentation:

``````round(X,Y): This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y. The default is to round to an integer.
``````

This example returns 4:

``````|eval test=round(3.5)
``````

This example returns 2.56:

|eval test=round(2.555, 2) Motivator

You will need the floor function. If you use round it will round up your number if the decimal is greater or equal to .5. And it will round down if you decimal is less than .5. Example:

your query|eval x=7/3 |eval x_round=round(x)|eval x_floor=floor(x) |table x x_round x_floor

Result set:

x x_round x_floor
2.333333 2 2 Engager

The problem with that is I want it to round DOWN not just round. That function doesn't let me do that as far as I know. Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!