Splunk Search

Show all values 0 to 100 with precision up to 2 decimal points

barunbiswas
New Member

I am working on a single value dashboard panel where I am showing output in percentage with precision up to 2 decimal points (e.g. 60.25%). However, I want shows 0 and 100 as a whole number (NO decimal point precision for these two). Please advise whether it is possible.

0 Karma

cmerriman
Super Champion

i think this might work for you, you'll have to code it into the SPL, not the formatting.

...|eval interestingField=if(numerator/denominator*100=0 OR numerator/denominator*100=100, numerator/denominator*100, round(numerator/denominator*100,2))
0 Karma

Sukisen1981
Champion

Hi,

Try this, assuming X is your single value field :
| eval x=if(floor(x)=x,floor(x),x)
| where x!=0
| eval x=x." %"
| fields _time,x

Based and checked my solution on this excellent entry - https://answers.splunk.com/answers/443308/how-to-round-values-to-2-decimal-places-but-only-f.html
Checked for 0 and with decimal, the solution works.
Set your number format to 0.00 in the single value visualization

0 Karma

barunbiswas
New Member

Thanks for your reply. However, it is not working in the dashboard.

0 Karma

Sukisen1981
Champion

can you be more specific? what is no working? no values or the decimal?

0 Karma

barunbiswas
New Member

In dashboard, it is showing all values in 0.00 format. I think that single value visualization format is taking precedence over the spl?

0 Karma

Sukisen1981
Champion

if you dont save it in the dashboard and just run the search and see the visualization tab, is that working?

0 Karma

Sukisen1981
Champion

why not just round off the single value field to 0 decimal places?

0 Karma

barunbiswas
New Member

I think I should have been more clear with my question. I want to show all values except 0 & 100 with precision up to 2 decimal points (e.g. 60.25%); and I want to show 0 & 100 as a whole number. Any advice on this please.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...