Splunk Search

How to shorten the numeric values for a field to only 2 decimals?

SecurityIsMyMid
Explorer

Here is my search fields + host,lastTime,dayDiff | eval c_time=strftime(log_time,"%m/%d/%y %H:%M:%S")
I'm trying to shorten daydiff to only 2 decimals. I've tried all the other answers and nothing seems to work.

0 Karma

sundareshr
Legend

Like this eval daydiff=round(daydiff, 2) before you do the strftime

SecurityIsMyMid
Explorer

My whole search is:

| `host_eventcount(30,2)` | search is_expected=true | `ctime(lastTime)`  | fields + host,lastTime,dayDiff  |rename host AS "Hostname", lastTime AS "Last Time Seen" , dayDiff AS "Days Not Seen" | eval c_time=strftime(log_time,"%m/%d/%y %H:%M:%S") 

Anyway to make this more efficient?

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...