Splunk Search

How to round the average in stats statement?

balash1979
Path Finder

Here is what i have

index="docker" (env = region1 OR env = region2)  "job-time" |eval time_in_mins = ('time')/(1000*60)  | stats avg(time_in_mins) as Time by env

How can I round the average to 2 decimals and then show by env ? Tried this but doesnt work
stats eval(round(avg(time_in_mins),2)) as Time by env

0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Add this after your stats:
|eval Time = round(Time,2)

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Add this after your stats:
|eval Time = round(Time,2)

------------
Hope I was able to help you. If so, some karma would be appreciated.

tscroggins
Influencer

This. You don't want to lose precision by rounding before the aggregation. You may also want to look at sigfig, various rounding modes, and the settings and capabilities of floating point math on your architecture, all depending on your use cases.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

?? Who is rounding before aggregation? I wrote to use the eval after the aggregation...

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

tscroggins
Influencer

The original poster. "This" was shorthand for agreeing with you.

Sukisen1981
Champion
|  stats  avg(eval(round(time_in_mins,2))) as Time by env
0 Karma

balash1979
Path Finder

The above doesnt work. I still get the answer with lot of digits after the decimal. It is not rounding.

0 Karma

Sukisen1981
Champion

hi @balash1979
You have to do what @diogofgm suggests,
This - |stats eval(round(avg(time_in_mins),2)) as Time by env will give you a splunk error, since round is not a function like max, or avg
This - | stats avg(eval(round(time_in_mins,2))) as Time by env will not remove decimals as you rightly pointed out. Even though the round works, in the last instance we again do an avg of the round, so this becomes something like say avg(10) by XXXX
And that won't be a round/whole number

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...