Having difficulty with simple rounding.
index=_internal group=per_sourcetype_thruput | eval gb=round(kb/1048576, 2)| stats sum(gb) sum(kb) by series |sort -sum(gb)
Incorrect GB in result:
series sum(gb) sum(kb)
wineventlog:security 1.66 4727905.487416
index=_internal group=per_sourcetype_thruput | eval gb=kb/1048576| stats sum(gb) sum(kb) by series |sort -sum(gb)
Correct GB in result without rounding:
series sum(gb) sum(kb)
wineventlog:security 4.5088820335775 4727905.487416
Have tried various versions of the base formula:
gb=round(kb/104856)
gb=round((kb/1024/1024), 2)
gb=round(((kb/1024)/1024), 2)
gb=round(kb/1024/1024)
But nothing works. What am I doing wrong?
If you round before summing up the values, you round off most of it before you can actually add it up. Most of the kb
values are small. If you divide any number less than 10,000 by 1,000,000 (or 1,048,576) and round to 2 places, it comes out to zero, so you end up adding up a whole bunch of zeros.
The solution is to round after you sum, e.g.:
index=_internal group=per_sourcetype_thruput
| stats sum(kb) as sum_kb by series
| eval sum_gb=round(sum_kb/1048576,2)
I think you need to sum the data in KB by Host rather than series. Each host has multiple sources and source types. It would be better to monitor the data throughput per host then series. Use the below search query:
index=_internal group=per_sourcetype_thruput | stats sum(kb) as DataKB, avg(kbps) as AVG-KBPS by host | eval DataGB=round(DataKB/1048576,2) | sort DataGB
Also mind that there should be no space while using the round function 🙂
The solution above it not working..
If you round before summing up the values, you round off most of it before you can actually add it up. Most of the kb
values are small. If you divide any number less than 10,000 by 1,000,000 (or 1,048,576) and round to 2 places, it comes out to zero, so you end up adding up a whole bunch of zeros.
The solution is to round after you sum, e.g.:
index=_internal group=per_sourcetype_thruput
| stats sum(kb) as sum_kb by series
| eval sum_gb=round(sum_kb/1048576,2)
I downvoted this post because solution is not working