limit timechart average values to two places

[dang]

I'm attempting to look at average free memory in GB on a number of servers (named server01, server02, etc) over time.

Doing this simple query I get the information I'm looking for, and the data is in gigabytes:

eventtype="windows_performance" Host="server*" object="Memory" counter="Available MBytes" |  eval FreeGB=(Value/1024) | timechart span=30m avg(FreeGB) by Host

The problem I'm encountering is that I'd like to present the timecharted values as having only two decimal places, and I can't figure out how. Using "round" in the eval statement [for example eval FreeGB=round((Value/1024),2)] doesn't seem to work.

Any suggestions?

[martin_mueller · Accepted solution]

You could roll it all into one eval timechart function:

... | timechart span=30m eval(round(avg(Value)/1024,2)) by Host

That will compute the average, convert to GB, and round to tens of MB.

[mattymo]

Just a heads up for anyone trying this, that eval naming is still required. Martin's example does it with the 'by' clause, or you can use the 'AS' to rename.

Won't work:

| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) 

^^ Error in 'timechart' command: The eval expression 'eval(round(avg(RMS_Watts_Tot),2))' must be renamed.

Works:

| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) AS watts
| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) by host

[dang]

Thank you, Martin. That was the answer I was looking for.

[HiroshiSatoh]

"ROUND" is okay. Do you want to be a display what results? Value Is it a numeric type?Error Is the output to "search.log"?

round((tonumber(Value)/1024),2)