Splunk Search

problem with rounding bytes to gb

Path Finder

Hello
I have use this command to convert from bytes to GB:
| eval b = b /1024/1024/1024
and this is an example value as result:
index1: 0.00000872090458869934
but the value is to long so I tried to round using this instead:
| foreach * [ eval <>=round('<>'/1024/1024/1024, 3)]
but then I get this result:
index1: 0.000
and I expect to get index1: 0.001

Can you suggest how to do that correctly so I get the expected result?

Labels (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Your expected result is not the correct result. 0.00000872090458869934 properly rounds to 0.000. To get a non-zero result, consider converting to MB rather than GB. Or try | eval b = max(0.001, b).
It's not necessary to use foreach to round the results. | eval b = round(b/1024/1024/1024, 3) would work

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Your expected result is not the correct result. 0.00000872090458869934 properly rounds to 0.000. To get a non-zero result, consider converting to MB rather than GB. Or try | eval b = max(0.001, b).
It's not necessary to use foreach to round the results. | eval b = round(b/1024/1024/1024, 3) would work

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

Thanks. But I have fields for every date so I have 31 fields thats why I use foreach.
About to use MB, what if for some values its more appropriate GB (big number)?
max(0.001, b) if I understand correctly this will do to show the bigger number from the two arguments? If yes then will kind work but thats kind of not what I want
I want to make round function work always but to round to upper border instead of both <5 || >5
I am sure I have seen this in C# but isn't there something similar in splunk?
Tried with ceiling() but this rounds to whole number so not what I need.

0 Karma

SplunkTrust
SplunkTrust

If you convert to MB and the number is big then convert it again to GB. You'll likely want to include units so users know if the display is MB or GB.

| eval B = if(b < 1*1024*1024, b/1024/1024 . " MB", b/1024/1024/1024 . " GB")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

I decided to use your first suggestion | eval b = max(0.001, b)
Thank you very much for fast response and smart idea for this.

0 Karma