Related Answers
Download topic as PDF
Mathematical functions
The following list contains the functions that you can use to perform mathematical calculations.
For information about using string and numeric fields in functions, and nesting functions, see Evaluation functions.
abs(X)
Description
This function takes a number X and returns its absolute value.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example creates a field called absnum, whose values are the absolute values of the numeric field number.
... | eval absnum=abs(number)
ceiling(X) or ceil(X)
Description
This function rounds a number X up to the next highest integer.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
You can use the abbreviation ceil(X) instead of the full name of the function.
Basic example
The following example returns n=2.
... | eval n=ceil(1.9)
exact(X)
Description
This function renders the result of a numeric eval calculation with a larger amount of precision in the formatted output.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
... | eval n=exact(3.14 * num)
exp(X)
Description
This function takes a number X and returns the exponential function eX.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example returns y=e3.
... | eval y=exp(3)
floor(X)
Description
This function rounds a number X down to the nearest whole integer.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example returns 1.
... | eval n=floor(1.9)
ln(X)
Description
This function takes a number X and returns its natural logarithm.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example returns the natural logarithm of the values of bytes.
... | eval lnBytes=ln(bytes)
log(X,Y)
Description
This function takes either one or two numeric arguments and returns the logarithm of the first argument X using the second argument Y as the base. If the second argument Y is omitted, this function evaluates the logarithm of number X with base 10.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
... | eval num=log(number,2)
pi()
Description
This function takes no arguments and returns the constant pi to 11 digits of precision.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example calculates the area of a circle, which is pi() multiplied by the radius to the power of 2.
... | eval area_circle=pi()*pow(radius,2)
pow(X,Y)
Description
This function takes two numeric arguments X and Y and returns XY, X to the power of Y.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example calculates the area of a circle, which is pi() multiplied by the radius to the power of 2.
... | eval area_circle=pi()*pow(radius,2)
round(X,Y)
Description
This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y. The default is to round to an integer.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic examples
The following example returns n=4.
... | eval n=round(3.5)
The following example returns n=2.56.
... | eval n=round(2.555, 2)
sigfig(X)
Description
This function takes one argument X, a number, and rounds that number to the appropriate number of significant figures.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
The computation for sigfig is based on the type of calculation that generates the number.
- For multiplication and division, the result should have the minimum number of significant figures of all of the operands.
- For addition and subtraction, the result should have the same number of decimal places as the least precise number of all of the operands.
For example, the numbers 123.0 and 4.567 contain different precision with the decimal places. The first number is less precise because it has 1 decimal place. The second number is more precise because it has 3 decimal places.
If the calculation is 123.0 + 4.567 = 127.567, then the sigfig function returns the fewest number of decimal places. In this example only one decimal place is returned. Because the numbers to the right of the last significant figure are greater than 5, the result returned is 127.6
Basic example
The calculation 1.00*1111 returns the value 1111, but the following search using the sigfig function returns n=1110.
... | eval n=sigfig(1.00*1111)
In this example, 1.00 has 3 significant figures and 1111 has 4 significant figures. In this example the minimum number of significant figures for all operands is 3. The final result is rounded to 3 digits, returning n=1110 and not 1111.
sqrt(X)
Description
This function takes one numeric argument X and returns its square root.
Usage
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic example
The following example returns 3:
... | eval n=sqrt(9)
|
PREVIOUS Informational functions |
NEXT Multivalue eval functions |
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 8.0.0
The round function appears to (more or less) support negative integer values for "Y" but this is not documented. EITHER: The sort-of-support should be eliminated (in the software code) or the documentation should be updated. See these Q&As:
https://answers.splunk.com/answers/529285/rounding-to-2-works-but-not-3.html
https://answers.splunk.com/answers/200468/round-problem.html