I have the following search:
index="monthlycdr" | eval "transporttype"=replace('Transport Type',"\"","") | eval "tt"=case( match(transporttype, "(?i)voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN") | stats count by tt
with the option:
![alt text][1]
And this is my result picture:
![alt text][2]
I know by default splunk has this percentage to 3 decimals. But is there anyway I could round it to 1? If not, how can I calculate it manually in my search base on the search that I have now? I've tried to calculate the percentage from my search but due to the case statement, I can't figure out a way to calculate the percentage value.
Thanks!
[1]: /storage/temp/219790-a.png
[2]: /storage/temp/219791-b.png
↧