Splunk Search

Limiting duration to 2 decimal places (without round function)

harshparikhxlrd
Path Finder

Hello, I was using the round function in my search to limit the results to 2 decimal places. I have gotten it to work for some numbers, but there are a few numbers that do not work, and typically display repeating decimals. I was wondering if there was a way to rectify this or possibly convert my functions into strings and limit the results to 2 decimal places that way?

0 Karma
1 Solution

jacobpevans
Motivator

Greetings @harshparikhxlrd,

You are rounding in this line: | eval dur = round(((hh * 3600) + (mm * 60) + ss),2), but then you take another average on this line: | stats avg(dur) as "Average Duration" by log, strr which will sometimes give repeating decimals.

You just need to round after the last average instead of before it, so your query should look more like this:

index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"")  
| rex "Automation=\"(?<Auto>.+?)\""
| where Auto = "SDA_E_AuditLog"
| rex "Message=\"(?<log>.+?)\""  
| rex "Duration:(?<hh>\d+):(?<mm>\d+):(?<ss>\d+\.\d+)" 
| eval dur = (hh * 3600) + (mm * 60) + ss
| rex "UserID=\"UNTOPR\\\(?<UID>.+?)\""  
| eval User = host." : ".UID  
| stats avg(dur) as "Average Duration" by log, User
| eval "Average Duration" = round('Average Duration',2)
| stats list(log) as Automation list("Average Duration") as "Average Duration (seconds)" by User
| table User Automation "Average Duration (seconds)"

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

jacobpevans
Motivator

Greetings @harshparikhxlrd,

You are rounding in this line: | eval dur = round(((hh * 3600) + (mm * 60) + ss),2), but then you take another average on this line: | stats avg(dur) as "Average Duration" by log, strr which will sometimes give repeating decimals.

You just need to round after the last average instead of before it, so your query should look more like this:

index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"")  
| rex "Automation=\"(?<Auto>.+?)\""
| where Auto = "SDA_E_AuditLog"
| rex "Message=\"(?<log>.+?)\""  
| rex "Duration:(?<hh>\d+):(?<mm>\d+):(?<ss>\d+\.\d+)" 
| eval dur = (hh * 3600) + (mm * 60) + ss
| rex "UserID=\"UNTOPR\\\(?<UID>.+?)\""  
| eval User = host." : ".UID  
| stats avg(dur) as "Average Duration" by log, User
| eval "Average Duration" = round('Average Duration',2)
| stats list(log) as Automation list("Average Duration") as "Average Duration (seconds)" by User
| table User Automation "Average Duration (seconds)"

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...