Splunk Search

If function returning integers?

jordanb93
Explorer

This code snippet is being used to calculate a time into a normal time in the H.M format. The numbers are something like 1.93 which means 1 hour and 93 minutes. I'm trying to convert this into 2.33 so it is more easily read/understood.

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x4=(x2/100)
| eval x3 = if(x4>=(0.60),((x4/.6)+x1),(x4+x1))

Unfortunately anytime the substring x4 is greater than .60 it returns a whole number 2 or 3 only.

Anyone have any ideas as too why it is doing this?

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=((x3/0.6)+x1)
| eval x6=(x3+x1)
| eval x4=if(x3>=.6,x5,x6)

Edit: I spread out the code to troubleshoot it and the error lies in '| eval x5=((x3/0.6)+x1)'
It seems to be rounding the number to a whole number if it is over '2'. I don't know the reason why though.

0 Karma
1 Solution

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

View solution in original post

0 Karma

jordanb93
Explorer

Solution:

| eval x5=exact((x3/0.6)+x1)

Adding the exact function to the equation forces it to not round the answer.

Edit:

| eval x1=substr(Total_Time_Refresh,1,1) 
| eval x2=substr(Total_Time_Refresh,3) 
| eval x3=(x2/100)
| eval x5=if(x3>.60,((x3-.60)+2),x3+1)
| eval Fixed_Refresh_Time = substr(x5,1,4)

This solution seems to be working but only will work on refreshes that are shorting than 3hrs which is over 99.9% of refreshes in my case and have alerts to go off if they are over 3hr.

0 Karma

jordanb93
Explorer

Although this solves the integer issue the time is now off. Still searching for solution that returns the correct time.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...