topic round fuction usage for avg command output in Splunk Search

round fuction usage for avg command output

rakesh_498115 — Wed, 30 May 2012 08:11:33 GMT

Hi ,

I have been using the stats avg(duration) as Avg_Duration in my query.But while displayin the Avg_Duration i am getting the output value with 6 decimal digits after the precision.Something like 2.123456 i would like to round it off to four digits only.Tried using the round function along with the stats command..but it didnt worked.

Please help me on this .Thanx

Re: round fuction usage for avg command output

Drainy — Wed, 30 May 2012 10:07:44 GMT

What have you tried already when you tried to round?
Something like this works with my setup;

| stats avg(duration) as Avg_duration | eval Avg_duration=round(Avg_duration,0)

Re: round fuction usage for avg command output

emikulic — Fri, 12 Sep 2014 00:28:09 GMT

It would be a lot better inline. I tried but as such in our 6.1.2 server cannot it does not work. ie.

 | stats round(avg(duration),0)

Re: round fuction usage for avg command output

damiensurat — Wed, 03 Apr 2019 15:35:15 GMT

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(duration,0))) AS Avg_Duration

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(duration(count,0))) AS Avg_Duration by something