Splunk Search

Rounding in chart with by clause

Contributor

I've just encountered a strange thing that doesn't seem to be covered by an Answer or the docs.
If I have a chart command without a 'by' clause, the standard method of rounding works:

[search]| chart avg(thruput_hr) as Thruput over "Run Date"  | eval Thruput=round(Thruput,2)

Results:
04/13 19.20
04/15 36.32
04/16 47.18
etc. as expected.

but if I add a by clause, it doesn't:

[search]| chart avg(thruput_hr) as Thruput over "Run Date" by year | eval Thruput=round(Thruput,2)

Results:
04/13 19.2

04/15 41.538461538 31.099
04/16 59.19 35.17241379

04/17 40.434782609 32.09
etc.

Is this WAD and I missed something, or is there a bug? Is there a way to do the rounding I want with chart?

0 Karma
1 Solution

Builder

If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.

[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

View solution in original post

Builder

If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.

[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

View solution in original post

Contributor

Yeah thought it might be something like that because I did notice that 'Thruput' wasn't listed. Interesting though, that it can be rounded even though it's hiding. Well, that's show business.

0 Karma