Dashboards & Visualizations

How to round off the result for a single value visualization to the nearest million?

mwdbhyat
Builder

Hi,

I have the following search:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon

The result is displayed in a single value visualization with a trend. I want to round the result off to the nearest million.. Any thoughts on how to do this?

Thanks

0 Karma
1 Solution

masonmorales
Influencer

You could do something like this:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000

You could also do this, but it might break your trend line:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M" 

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000
0 Karma

masonmorales
Influencer

You could do something like this:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000

You could also do this, but it might break your trend line:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M" 
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...