Splunk Search

How to round stats average to 2 decimal places?

markthompson
Builder

Hello,
I have this:

stats count by opentime | stats avg(count)

and I want the average to be in 2dp.

Anyone have any suggestions?

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something

esalesap
Path Finder

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).

brettcave
Builder

very useful, thanks @damiensurat

0 Karma

lakromani
Builder

I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2

0 Karma

bschandramohan
Engager

It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

gkanapathy
Splunk Employee
Splunk Employee

if you really like the name avg(count) I believe you can do it by quoting the name:

... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

damiensurat
Contributor

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something

0 Karma

gene_tien
Observer

This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work. 

0 Karma

AdsicSplunk
New Member

Hi,

I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...