I am using below query :
`linux-cpu` | search application=pc4_BizX host=* sub_module=* | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | rename sub_module AS "Sub Module" pctLoad AS "CPU %"
Getting results like below:
Sub Module CPU % pctUser pctSystem pctNice pctIowait
pc4_BizX 87.290618 0.000000 1.068261 0.439008 0.000000
pc4_BizX_A 95.066103 0.054263 0.026636 0.544853 0.000155
pc4_BizX_W 98.705398 0.000000 0.019912 0.544605 0.000000
How do I round up to 2 digits after the decimal? Here I am getting 6 digits after the decimal.
You can use the eval command
linux-cpu | search application=pc4_BizX host= sub_module= | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | eval sub_module=round(sub_module,2) |eval pctLoad=round(pctLoad,2) | rename sub_module AS "Sub Module" pctLoad AS "CPU %"
Reference:
http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Eval
You can use the eval command
linux-cpu | search application=pc4_BizX host= sub_module= | stats avg(pctIdle) AS pctLoad avg(pctUser) as pctUser avg(pctSystem) as pctSystem avg(pctNice) as pctNice avg(pctIowait) as pctIowait by sub_module | eval sub_module=round(sub_module,2) |eval pctLoad=round(pctLoad,2) | rename sub_module AS "Sub Module" pctLoad AS "CPU %"
Reference:
http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Eval
Thanks it worked !!!