Here is how I do it:
stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count
[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]
This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something
Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).
very useful, thanks @damiensurat
I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2
It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.
Here is how I do it:
stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
if you really like the name avg(count)
I believe you can do it by quoting the name:
... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)
I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count
[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]
This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something
This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work.
Hi,
I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.