Splunk Search

Round down

KaliBaker
Engager

I have a function where I take a number, divide it by 3, then would like to round that number down. Is that possible to do in Splunk? Could I instead use something like split()?

Tags (1)
0 Karma
1 Solution

cphair
Builder

Use eval's floor function.


| eval foo=floor(Value/3)

This gives you an integer, but if you really need to maintain some decimal places you could do some extra math, like eval foo=(floor(Value*100/3))/100 to get 2 places.

View solution in original post

cphair
Builder

Use eval's floor function.


| eval foo=floor(Value/3)

This gives you an integer, but if you really need to maintain some decimal places you could do some extra math, like eval foo=(floor(Value*100/3))/100 to get 2 places.

View solution in original post

lpolo
Motivator

Try the round function:
As presented in the documentation:

round(X,Y): This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y. The default is to round to an integer.

This example returns 4:

|eval test=round(3.5)

This example returns 2.56:

|eval test=round(2.555, 2)

lpolo
Motivator

You will need the floor function. If you use round it will round up your number if the decimal is greater or equal to .5. And it will round down if you decimal is less than .5. Example:

your query|eval x=7/3 |eval x_round=round(x)|eval x_floor=floor(x) |table x x_round x_floor

Result set:

x x_round x_floor
2.333333 2 2

0 Karma

KaliBaker
Engager

The problem with that is I want it to round DOWN not just round. That function doesn't let me do that as far as I know.

0 Karma