Dashboards & Visualizations

How to round off the result for a single value visualization to the nearest million?

mwdbhyat
Builder

Hi,

I have the following search:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon

The result is displayed in a single value visualization with a trend. I want to round the result off to the nearest million.. Any thoughts on how to do this?

Thanks

0 Karma
1 Solution

masonmorales
Influencer

You could do something like this:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000

You could also do this, but it might break your trend line:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M" 

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000
0 Karma

masonmorales
Influencer

You could do something like this:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000

You could also do this, but it might break your trend line:

| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M" 
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...