Splunk Search

Rounding in chart with by clause

cmeo
Contributor

I've just encountered a strange thing that doesn't seem to be covered by an Answer or the docs.
If I have a chart command without a 'by' clause, the standard method of rounding works:

[search]| chart avg(thruput_hr) as Thruput over "Run Date"  | eval Thruput=round(Thruput,2)

Results:
04/13 19.20
04/15 36.32
04/16 47.18
etc. as expected.

but if I add a by clause, it doesn't:

[search]| chart avg(thruput_hr) as Thruput over "Run Date" by year | eval Thruput=round(Thruput,2)

Results:
04/13 19.2

04/15 41.538461538 31.099
04/16 59.19 35.17241379

04/17 40.434782609 32.09
etc.

Is this WAD and I missed something, or is there a bug? Is there a way to do the rounding I want with chart?

0 Karma
1 Solution

dineshraj9
Builder

If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.

[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

View solution in original post

dineshraj9
Builder

If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.

[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

cmeo
Contributor

Yeah thought it might be something like that because I did notice that 'Thruput' wasn't listed. Interesting though, that it can be rounded even though it's hiding. Well, that's show business.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...