Round down

[KaliBaker]

I have a function where I take a number, divide it by 3, then would like to round that number down. Is that possible to do in Splunk? Could I instead use something like split()?

[cphair · Accepted solution]

Use eval's floor function.

| eval foo=floor(Value/3)

This gives you an integer, but if you really need to maintain some decimal places you could do some extra math, like eval foo=(floor(Value*100/3))/100 to get 2 places.

[lpolo]

Try the round function:
As presented in the documentation:

round(X,Y): This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y. The default is to round to an integer.

This example returns 4:

|eval test=round(3.5)

This example returns 2.56:

|eval test=round(2.555, 2)

[lpolo]

You will need the floor function. If you use round it will round up your number if the decimal is greater or equal to .5. And it will round down if you decimal is less than .5. Example:

your query|eval x=7/3 |eval x_round=round(x)|eval x_floor=floor(x) |table x x_round x_floor

Result set:

x x_round x_floor
2.333333 2 2

[KaliBaker]

The problem with that is I want it to round DOWN not just round. That function doesn't let me do that as far as I know.