Splunk Search

How to round stats average to 2 decimal places?

markthompson
Builder

Hello,
I have this:

stats count by opentime | stats avg(count)

and I want the average to be in 2dp.

Anyone have any suggestions?

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something

esalesap
Path Finder

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).

brettcave
Builder

very useful, thanks @damiensurat

0 Karma

lakromani
Builder

I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2

0 Karma

bschandramohan
Engager

It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

gkanapathy
Splunk Employee
Splunk Employee

if you really like the name avg(count) I believe you can do it by quoting the name:

... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

damiensurat
Contributor

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something

0 Karma

gene_tien
Observer

This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work. 

0 Karma

AdsicSplunk
New Member

Hi,

I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...