Splunk Search

How to round stats average to 2 decimal places?

markthompson
Builder

Hello,
I have this:

stats count by opentime | stats avg(count)

and I want the average to be in 2dp.

Anyone have any suggestions?

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something

esalesap
Path Finder

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).

brettcave
Builder

very useful, thanks @damiensurat

0 Karma

lakromani
Builder

I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2

0 Karma

bschandramohan
Engager

It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

gkanapathy
Splunk Employee
Splunk Employee

if you really like the name avg(count) I believe you can do it by quoting the name:

... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

damiensurat
Contributor

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something

0 Karma

gene_tien
Observer

This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work. 

0 Karma

AdsicSplunk
New Member

Hi,

I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...