Splunk Search

How to round values to 2 decimal places, but only for values with non zeros?

splunker9999
Path Finder

Hi,

We have a search which gives us availability of our platforms. We used the syntax below to round for 2 decimal places.

| stats avg(Value) as Average|eval Average=round((Average*100),2)|eval range=if(Average >=0, "low", "severe")

This is giving us results like below

Average
100.00
99.99

Now we want to round off only for values which have non zero in decimal places. Can we do this?
Output should show like this below.

Average
100
99.99
0 Karma

somesoni2
Revered Legend

Try like this

| stats avg(Value) as Average|eval Average=round((Average*100),2) | eval Average=if(floor(Average)=Average,floor(Average),Average) |eval range=if(Average >=0, "low", "severe")
0 Karma

splunker9999
Path Finder

In statistics it is displaying as correct value, but in single value panel it is rounding to the nearest value.

If result is as 99.99 , it is rounding to 100 in single value panel?

Also can you please advice how can we append Pecentage to value in single value panel?

0 Karma

somesoni2
Revered Legend

The single value visualization has default numberPrecision as 0, so it'll round off while displaying. You could either edit the visualization to increase this precision to 2 digits, but it may temper with full numbers then.

I think below query will resolve both your issues, rounding off and adding % sign

| stats avg(Value) as Average|eval Average=round((Average*100),2) | eval Average=if(floor(Average)=Average,floor(Average),Average) |eval range=if(Average >=0, "low", "severe") | eval Average=Average." %"
0 Karma

pgrantham_splun
Splunk Employee
Splunk Employee

Another easy way you could do it is using a modulo operation:

| eval Average = if(Average%1>0,round(Average*100,2),Average*100) 

Edit: Added the *100 so you can get what I believe is the desired result in one eval.

0 Karma

beatus
Communicator

Splunker9999,

You could combo it up with an if statement in your eval:

|eval Average=round((Average*100),2) |eval Average = if(match(Average, "\.[0]+$"),  round((Average),0), round((Average),2) )

There may be a way to combine it up into one eval, but i'm blanking on it.

0 Karma

splunker9999
Path Finder

In statistics it is displaying as correct value, but in single value panel it is rounding to the nearest value.

If result is as 99.99 , it is rounding to 100 in single value panel?

Also can you please advice how can we append Pecentage to value in single value panel?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...