Splunk Search

TimeChart round values: How to create search?

DPOIRE
Path Finder

I need to round the max(Delay) and avg(Delay) to 3 decimals in the following command:
my search | timechart span=5m avg(Delay) max(Delay) by host
Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

sorry my error!

my search 
| bin span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@DPOIRE You can certainly calculate as many values in timechart as you like and round them as needed, although rounding after a timechart+split_by needs to use "foreach" because the field names are named by the split field (in your case 'host')

| timechart span=5m avg(Delay) max(Delay) by host
| foreach * [ eval "<<FIELD>>"=round('<<FIELD>>', 3) ]

Note that the left hand side of eval uses double quotes and the right hand side, single, round the <<FIELD>>.

That is to take care of any potential odd characters in the host results.

 

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

for my knowledge, you cannot calculate two values in timechart, so you need to use stats,

please try this:

my search 
| span span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

0 Karma

DPOIRE
Path Finder

DPOIRE_0-1663946437101.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DPOIRE,

sorry my error!

my search 
| bin span=5m _time
| stats avg(Delay) AS avgDelay max(Delay) AS maxDelay by _time host
| eval avgDelay=round(avgDelay,3), maxDelay=round(maxDelay,3)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...