Splunk Search

## Rounding anomaly?

Builder

I'm getting what I believe are strange results when using the round function to control the number of decimal places. This is a search that I have in a dashboard to calculate how much data (in GB) that I have indexed in the last 24 hours:

``````index="_internal" source="*metrics.log" per_index_thruput| eval GB=kb/1024/1024 | stats sum(GB) as total
``````

The result of the above search is: 7.8531551056447. I wanted to round to 2 decimal places so I modified the search to use the round function like this:

``````index="_internal" source="*metrics.log" per_index_thruput| eval GB=round((kb/1024/1024),2) | stats sum(GB) as total
``````

However, the result of the above search is: 0.15 (instead of 7.85). So, I tried the same search but this time to 3 decimal places like this:

``````index="_internal" source="*metrics.log" per_index_thruput| eval GB=round((kb/1024/1024),3) | stats sum(GB) as total
``````

The result of the above search is: 7.21 which is closer to the expected result of 7.85 but still not 100% accurate.

So, I tried 4 decimal places like this:

``````index="_internal" source="*metrics.log" per_index_thruput| eval GB=round((kb/1024/1024),4) | stats sum(GB) as total
``````

And the result of the above search is 7.8405 which is almost accurate/correct. But, I don't want 4 decimal places...

What am I doing wrong, why does the search with 2 decimal places return 0.15? Thanks!

Tags (2)
1 Solution
Revered Legend

Try this.

``````index="_internal" source="*metrics.log" per_index_thruput| eval GB=kb/1024/1024 | stats sum(GB) as total | eval sum(GB)=round(sum(GB),2)
``````
SplunkTrust

This is not yet an answer, just informational: last November we did open a case with support because of this `eval` example:

``````index=main | eval result=0.2-0 | head 10 | table result
``````

This example shows the calculation of 0.2 minus 0, which gives 0.2, looks good so far ... but, when we multiply 0 with 0.1 first, like this:

``````index=main | eval result=0.2-(0*0.1) | head 10 | table result
``````

which should end up in 0.2 as well (0 * 0.1 is 0, 0.2 minus 0 is 0.2). But Splunk gives back zero (0) instead.

Update: This will be handled in SPL-76889, eval multiplication with 0.

cheers, MuS

Revered Legend

Very interesting. It seems Splunk is rounding off "0.2" to integer (0 decimal) and thus giving 0. Used "0.5" or "0.45" gave me 1.

SplunkTrust

update ping

Builder

Interesting, thanks for the info!

Revered Legend

Try this.

``````index="_internal" source="*metrics.log" per_index_thruput| eval GB=kb/1024/1024 | stats sum(GB) as total | eval sum(GB)=round(sum(GB),2)
``````
Builder

The |eval total=round(total,2) works great and doesn't have the same problem as my original search. Thanks!

Revered Legend

My bad. replace eval stmt with this.

|eval total==round(total,2)

Builder

Thanks but I got the following error when I tried this search:

Error in 'eval' command: The 'sum' function is unsupported or undefined.

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!