Dashboards & Visualizations

How to round off the result for a single value visualization to the nearest million?

mwdbhyat
Builder

Hi,

I have the following search:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon

The result is displayed in a single value visualization with a trend. I want to round the result off to the nearest million.. Any thoughts on how to do this?

Thanks

0 Karma
1 Solution

masonmorales
Influencer

You could do something like this:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000

You could also do this, but it might break your trend line:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M" 

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000
0 Karma

masonmorales
Influencer

You could do something like this:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000

You could also do this, but it might break your trend line:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M" 
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...