Splunk Search

TimeChart round values: How to create search?

DPOIRE
Path Finder

I need to round the max(Delay) and avg(Delay) to 3 decimals in the following command:
my search | timechart span=5m avg(Delay) max(Delay) by host
Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

sorry my error!

my search 
| bin span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@DPOIRE You can certainly calculate as many values in timechart as you like and round them as needed, although rounding after a timechart+split_by needs to use "foreach" because the field names are named by the split field (in your case 'host')

| timechart span=5m avg(Delay) max(Delay) by host
| foreach * [ eval "<<FIELD>>"=round('<<FIELD>>', 3) ]

Note that the left hand side of eval uses double quotes and the right hand side, single, round the <<FIELD>>.

That is to take care of any potential odd characters in the host results.

 

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

for my knowledge, you cannot calculate two values in timechart, so you need to use stats,

please try this:

my search 
| span span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

0 Karma

DPOIRE
Path Finder

DPOIRE_0-1663946437101.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

sorry my error!

my search 
| bin span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...