problem with rounding bytes to gb

[net1993]

Hello
I have use this command to convert from bytes to GB:
| eval b = b /1024/1024/1024
and this is an example value as result:
index1: 0.00000872090458869934
but the value is to long so I tried to round using this instead:
| foreach * [ eval <>=round('<>'/1024/1024/1024, 3)]
but then I get this result:
index1: 0.000
and I expect to get index1: 0.001

Can you suggest how to do that correctly so I get the expected result?

[richgalloway · Accepted solution]

Your expected result is not the correct result. 0.00000872090458869934 properly rounds to 0.000. To get a non-zero result, consider converting to MB rather than GB. Or try | eval b = max(0.001, b).
It's not necessary to use foreach to round the results. | eval b = round(b/1024/1024/1024, 3) would work

[net1993]

Thanks. But I have fields for every date so I have 31 fields thats why I use foreach.
About to use MB, what if for some values its more appropriate GB (big number)?
max(0.001, b) if I understand correctly this will do to show the bigger number from the two arguments? If yes then will kind work but thats kind of not what I want
I want to make round function work always but to round to upper border instead of both <5 || >5
I am sure I have seen this in C# but isn't there something similar in splunk?
Tried with ceiling() but this rounds to whole number so not what I need.

[richgalloway]

If you convert to MB and the number is big then convert it again to GB. You'll likely want to include units so users know if the display is MB or GB.

| eval B = if(b < 1*1024*1024, b/1024/1024 . " MB", b/1024/1024/1024 . " GB")

[net1993]

I decided to use your first suggestion | eval b = max(0.001, b)
Thank you very much for fast response and smart idea for this.