Dashboards & Visualizations

Panel using Round and Sort

hsh
New Member

Hi

I have a dashboard that displays the numerial value of a field called method_duration.

The value is in ms.

The search string I have looks like this:

index=bec_ci_prod ("deploy_status_type=info" "direction=exiting") | sort + method_duration | chart count by method_duration span=10000

The result from thus is actually as expected. But now I would like to show the method_duration in seconds and not in miliseconds

I then add this to the search string:
| fieldformat method_duration=round(method_duration/1000)

The result is that when listing the result several of the results now have the same value like 5-6 results showing 0 etc.

How could you get Spluk to show all the rounded numbers that end up being 0 in just one result ?

Also when i try to add the span=10 all the results values are blank but the count remains. I think it has something to do with the first problem where multiple results now sjhow the same value

Any idea how to solve this ?

Tags (1)
0 Karma
1 Solution

inventsekar
Ultra Champion

Maybe, try eval round function -

| eval method_duration=round(method_duration/1000,3)

View solution in original post

0 Karma

hsh
New Member

thanks guys that helped with the results

0 Karma

inventsekar
Ultra Champion

Maybe, try eval round function -

| eval method_duration=round(method_duration/1000,3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

you can use second instead miliseconds inserting an eval command like this before chart command
| eval method_duration=method_duration/1000
and obviously modifying span.
After this you can round your number to the decimals you prefer.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...