Splunk Search

TimeChart round values: How to create search?

DPOIRE
Path Finder

I need to round the max(Delay) and avg(Delay) to 3 decimals in the following command:
my search | timechart span=5m avg(Delay) max(Delay) by host
Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

sorry my error!

my search 
| bin span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@DPOIRE You can certainly calculate as many values in timechart as you like and round them as needed, although rounding after a timechart+split_by needs to use "foreach" because the field names are named by the split field (in your case 'host')

| timechart span=5m avg(Delay) max(Delay) by host
| foreach * [ eval "<<FIELD>>"=round('<<FIELD>>', 3) ]

Note that the left hand side of eval uses double quotes and the right hand side, single, round the <<FIELD>>.

That is to take care of any potential odd characters in the host results.

 

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

for my knowledge, you cannot calculate two values in timechart, so you need to use stats,

please try this:

my search 
| span span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

0 Karma

DPOIRE
Path Finder

DPOIRE_0-1663946437101.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

sorry my error!

my search 
| bin span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...