https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431399#M172483 <P>Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span> and single quoted on expressions area, like this</P> <PRE><CODE>index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 | eval User=lower(User) | stats count(eval(responsestatus="200")) as success_count count(eval(responsestatus="503")) as failure_count by User | appendpipe [ stats avg(success_count) as avg-success_count | eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] | appendpipe [ stats avg(failure_count) as avg-failure_count | eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)] | sort 0 +User </CODE></PRE> Wed, 13 Mar 2019 19:01:50 GMT somesoni2 2019-03-13T19:01:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431398#M172482 <P>This search works well and gives me the results I want as shown below:</P> <PRE><CODE>index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 | eval User=lower(User) | stats count(eval(responsestatus="200")) as success_count count(eval(responsestatus="503")) as failure_count by User | appendpipe [ stats avg(success_count) as avg-success_count | eval User="Average Successes"] | appendpipe [ stats avg(failure_count) as avg-failure_count | eval User="Average Failures"] | sort 0 +User </CODE></PRE> <P>Sample results:</P> <PRE><CODE>**User success_count failure_count avg-failure_count avg-success_count** Average Failures 0.092400317 Average Successes 135.6589156 user1 106 0 user2 88 0 etc. </CODE></PRE> <P>How do I round the values for avg-failure_count and avg-success_count? When I tried the following I got no result for avg-</P> <PRE><CODE>success_count and avg-failure_count. | appendpipe [ stats avg(success_count) as avg-success_count | eval User="Average Successes" |eval avg-success_count=round(avg-success_count,2)] | appendpipe [ stats avg(failure_count) as avg-failure_count | eval User="Average Failures" |eval avg-failure_count=round(avg-failure_count,2)] </CODE></PRE> <P>Thanks!</P> Tue, 29 Sep 2020 23:38:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431398#M172482 JarrettM 2020-09-29T23:38:07Z https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431399#M172483 <P>Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span> and single quoted on expressions area, like this</P> <PRE><CODE>index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 | eval User=lower(User) | stats count(eval(responsestatus="200")) as success_count count(eval(responsestatus="503")) as failure_count by User | appendpipe [ stats avg(success_count) as avg-success_count | eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] | appendpipe [ stats avg(failure_count) as avg-failure_count | eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)] | sort 0 +User </CODE></PRE> Wed, 13 Mar 2019 19:01:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431399#M172483 somesoni2 2019-03-13T19:01:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431400#M172484 <P>Thank you!! I had no idea about the - vs _ issue or the need for ' ' vs " " quotes. I'll avoid those pesky hyphens from now on!</P> <P>Perfect answer!</P> Thu, 14 Mar 2019 11:41:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-round-function-in-appendpipe/m-p/431400#M172484 JarrettM 2019-03-14T11:41:58Z