Here is what i have
index="docker" (env = region1 OR env = region2) "job-time" |eval time_in_mins = ('time')/(1000*60) | stats avg(time_in_mins) as Time by env
How can I round the average to 2 decimals and then show by env ? Tried this but doesnt work
stats eval(round(avg(time_in_mins),2)) as Time by env
This. You don't want to lose precision by rounding before the aggregation. You may also want to look at sigfig, various rounding modes, and the settings and capabilities of floating point math on your architecture, all depending on your use cases.
?? Who is rounding before aggregation? I wrote to use the eval after the aggregation...
You have to do what @diogofgm suggests,
|stats eval(round(avg(time_in_mins),2)) as Time by env will give you a splunk error, since round is not a function like max, or avg
| stats avg(eval(round(time_in_mins,2))) as Time by env will not remove decimals as you rightly pointed out. Even though the round works, in the last instance we again do an avg of the round, so this becomes something like say avg(10) by XXXX
And that won't be a round/whole number