Splunk Search

## How to round stats average to 2 decimal places?

Builder

Hello,
I have this:

stats count by opentime | stats avg(count)

and I want the average to be in 2dp.

Anyone have any suggestions?

Tags (4)
1 Solution
SplunkTrust

Here is how I do it:

``````stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
``````
---
If this reply helps you, Karma would be appreciated.
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something

Path Finder

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).

Builder

very useful, thanks @damiensurat

Builder

I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2

Engager

It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.

SplunkTrust

Here is how I do it:

``````stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
``````
---
If this reply helps you, Karma would be appreciated.
Splunk Employee

if you really like the name `avg(count)` I believe you can do it by quoting the name:

``````... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)
``````
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count

Contributor

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something

Observer

This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work.

New Member

Hi,

I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.

Get Updates on the Splunk Community!