Splunk Search

Rounding in chart with by clause

cmeo
Contributor

I've just encountered a strange thing that doesn't seem to be covered by an Answer or the docs.
If I have a chart command without a 'by' clause, the standard method of rounding works:

[search]| chart avg(thruput_hr) as Thruput over "Run Date"  | eval Thruput=round(Thruput,2)

Results:
04/13 19.20
04/15 36.32
04/16 47.18
etc. as expected.

but if I add a by clause, it doesn't:

[search]| chart avg(thruput_hr) as Thruput over "Run Date" by year | eval Thruput=round(Thruput,2)

Results:
04/13 19.2

04/15 41.538461538 31.099
04/16 59.19 35.17241379

04/17 40.434782609 32.09
etc.

Is this WAD and I missed something, or is there a bug? Is there a way to do the rounding I want with chart?

0 Karma
1 Solution

dineshraj9
Builder

If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.

[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

View solution in original post

dineshraj9
Builder

If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.

[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

cmeo
Contributor

Yeah thought it might be something like that because I did notice that 'Thruput' wasn't listed. Interesting though, that it can be rounded even though it's hiding. Well, that's show business.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...