Splunk Search

How to round stats average to 2 decimal places?

markthompson
Builder

Hello,
I have this:

stats count by opentime | stats avg(count)

and I want the average to be in 2dp.

Anyone have any suggestions?

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something

esalesap
Path Finder

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).

brettcave
Builder

very useful, thanks @damiensurat

0 Karma

lakromani
Builder

I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2

0 Karma

bschandramohan
Engager

It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

gkanapathy
Splunk Employee
Splunk Employee

if you really like the name avg(count) I believe you can do it by quoting the name:

... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

damiensurat
Contributor

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something

0 Karma

gene_tien
Observer

This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work. 

0 Karma

AdsicSplunk
New Member

Hi,

I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...