Splunk Search

problem with rounding bytes to gb

net1993
Path Finder

Hello
I have use this command to convert from bytes to GB:
| eval b = b /1024/1024/1024
and this is an example value as result:
index1: 0.00000872090458869934
but the value is to long so I tried to round using this instead:
| foreach * [ eval <>=round('<>'/1024/1024/1024, 3)]
but then I get this result:
index1: 0.000
and I expect to get index1: 0.001

Can you suggest how to do that correctly so I get the expected result?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your expected result is not the correct result. 0.00000872090458869934 properly rounds to 0.000. To get a non-zero result, consider converting to MB rather than GB. Or try | eval b = max(0.001, b).
It's not necessary to use foreach to round the results. | eval b = round(b/1024/1024/1024, 3) would work

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Your expected result is not the correct result. 0.00000872090458869934 properly rounds to 0.000. To get a non-zero result, consider converting to MB rather than GB. Or try | eval b = max(0.001, b).
It's not necessary to use foreach to round the results. | eval b = round(b/1024/1024/1024, 3) would work

---
If this reply helps you, Karma would be appreciated.

net1993
Path Finder

Thanks. But I have fields for every date so I have 31 fields thats why I use foreach.
About to use MB, what if for some values its more appropriate GB (big number)?
max(0.001, b) if I understand correctly this will do to show the bigger number from the two arguments? If yes then will kind work but thats kind of not what I want
I want to make round function work always but to round to upper border instead of both <5 || >5
I am sure I have seen this in C# but isn't there something similar in splunk?
Tried with ceiling() but this rounds to whole number so not what I need.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you convert to MB and the number is big then convert it again to GB. You'll likely want to include units so users know if the display is MB or GB.

| eval B = if(b < 1*1024*1024, b/1024/1024 . " MB", b/1024/1024/1024 . " GB")
---
If this reply helps you, Karma would be appreciated.
0 Karma

net1993
Path Finder

I decided to use your first suggestion | eval b = max(0.001, b)
Thank you very much for fast response and smart idea for this.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...