Splunk Search

Is there a shorthand way to round all values in a search without using "eval value=round()" for each individual value?

HattrickNZ
Motivator

if I have the following search that gives:

   _time        val1           val2       val3            val4
1  2016-02-22   14298.520982   2083.388889   10311.996070668   1658.393286670

Is there a shorthand way to round all the numbers?

Or do I just have to do a round on each val

| eval val1=round(val1,2)....

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

What you need is a foreach command
http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Foreach

Something like this

your current search giving above output |  foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

View solution in original post

somesoni2
Revered Legend

What you need is a foreach command
http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Foreach

Something like this

your current search giving above output |  foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]

HattrickNZ
Motivator

tks, that exactly what I was looking for

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...