Splunk Search

Round problem

lukasz92
Communicator

When I enter this query:

index=_internal | head 100 | eval time1=round(_time,0) | eval time2=round(_time,-3) | eval time3=round(_time,-2) | eval time4=round(_time,-1) | eval time5=round(987987778768,-4) | table time1,time2,time3,time4,time5

I get -nan in columns when second parameter of round function is less than -2.
When -2 , everything is rounded to the -2 place after the dot (it equals second place beforce the dot)

Could you explain why?
Is this bug or a feature? 🙂

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

To get around the syntax ugliness you can define a macro round(2) with arguments $x$,$y$ as (round($x$*pow(10,$y$))/pow(10,$y$)) and call that like this:

... | eval time2 = `round(_time, -3)` | ...

View solution in original post

0 Karma

lukasz92
Communicator

Solution works, but I think this is a faulty function.
Could I trust "pow", or there are another crazy limitations I don't know? 😕

It is not documented what the second parameter should look like,
@richgalloway comment should definetly appear in the official documentation.

0 Karma

Ayn
Legend

I disagree with that interpretation. The documentation states:

This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y.

It makes no sense in this context to mention negative integers at all.

0 Karma

lukasz92
Communicator

Shouldn't args be tested for invalid values?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

To get around the syntax ugliness you can define a macro round(2) with arguments $x$,$y$ as (round($x$*pow(10,$y$))/pow(10,$y$)) and call that like this:

... | eval time2 = `round(_time, -3)` | ...
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The documentation for the round() function does not mention use of negative values for the second argument. Based on that and your experience, I conclude they are not supported.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ayn
Legend

What's the idea with supplying a negative integer there at all?

0 Karma

lukasz92
Communicator

negative integer after a dot = positive integer before a dot - isn't it logic?
I want to round a number to thousands (1345 -> 1000 ; 1501 -> 2000).
Syntax round(1345/1000,0)*1000 is uglier

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...