Splunk Search

## i want to show two decimals after integer without changing values and if we give integer(52) also then output like 52.00 New Member

HI,

a=0.54689556898
b=1.25698
c=0.5
d=51

I want output like

a=0.54
b=1.25
c=0.50
d=51.00

Please do needful, how to write query

i tried with this query but i am not getting
| makeresults |eval Total=0.8 | rex Field=Total "(?.).(?.)" |eval EMP2=substr(FieldC,0,len(FieldC)-1) | eval Result= FieldB.".".EMP2 |eval Result1=round(Result,3) | eval EMP5=substr(Result1,0,len(Result1)-1) | fields - FieldC, EMP2, FieldB, Result, Result1, _time

Tags (3)
1 Solution  SplunkTrust

EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.

Rounding a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...

``````| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,2)
``````

My results are

``````num_2   nums
51.00   51
1.26    1.25698
0.55    0.54689556898
0.50    0.5
``````

Truncation: If instead you really need truncation, combine the above technique with a rex.

``````| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,3)
| rex field=num_2 "(?<num>\d+\.\d{2})"
``````

What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.

That truncates like I think you might want!

Happy Splunking! Let me know if this works for you!

-Rich  SplunkTrust

Hi
did you tried with round function?

``````| eval your_field=round(your_field,2)
``````

Bye.
Giuseppe  SplunkTrust

EDIT: Rounding MIGHT do what you want, if it will work for you it's easier and faster. IF not, SCROLL DOWN there's a way to do this with truncation too.

Rounding a single-precision number to two decimal places actually adds digits, so 0.5 rounds to 0.50. Here's your 4 numbers in a run-anywhere to show that...

``````| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,2)
``````

My results are

``````num_2   nums
51.00   51
1.26    1.25698
0.55    0.54689556898
0.50    0.5
``````

Truncation: If instead you really need truncation, combine the above technique with a rex.

``````| makeresults
| eval nums=split("0.54689556898 1.25698 0.5 51", " ")
| mvexpand nums
| eval num_2 = round(nums,3)
| rex field=num_2 "(?<num>\d+\.\d{2})"
``````

What I do there is round to one extra digit (0.546) - now we have a known number of digits, so the rex just pulls out the integer part, then the first two decimals.

That truncates like I think you might want!

Happy Splunking! Let me know if this works for you!

-Rich New Member

Finally i got output.

Thank you Very much bro  SplunkTrust 