Splunk Search

How to use round function in appendpipe?

JarrettM
Path Finder

This search works well and gives me the results I want as shown below:

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
    count(eval(responsestatus="200")) as success_count
    count(eval(responsestatus="503")) as failure_count 
    by User 
| appendpipe 
    [ stats avg(success_count) as avg-success_count 
    | eval User="Average Successes"] 
| appendpipe 
    [ stats avg(failure_count) as avg-failure_count 
    | eval User="Average Failures"]
| sort 0 +User

Sample results:

**User                success_count         failure_count               avg-failure_count   avg-success_count**
Average Failures                                                                        0.092400317 
Average Successes                                                                                                      135.6589156
user1                         106                          0        
user2                          88                          0        
etc.            

How do I round the values for avg-failure_count and avg-success_count? When I tried the following I got no result for avg-

success_count  and avg-failure_count.
| appendpipe 
    [ stats avg(success_count) as avg-success_count 
    | eval User="Average Successes"
     |eval avg-success_count=round(avg-success_count,2)] 
| appendpipe 
    [ stats avg(failure_count) as avg-failure_count 
    | eval User="Average Failures"
     |eval avg-failure_count=round(avg-failure_count,2)] 

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of 😃 and single quoted on expressions area, like this

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
count(eval(responsestatus="200")) as success_count
count(eval(responsestatus="503")) as failure_count 
by User 
| appendpipe 
[ stats avg(success_count) as avg-success_count 
| eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] 
| appendpipe 
[ stats avg(failure_count) as avg-failure_count 
| eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)]
| sort 0 +User

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of 😃 and single quoted on expressions area, like this

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
count(eval(responsestatus="200")) as success_count
count(eval(responsestatus="503")) as failure_count 
by User 
| appendpipe 
[ stats avg(success_count) as avg-success_count 
| eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] 
| appendpipe 
[ stats avg(failure_count) as avg-failure_count 
| eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)]
| sort 0 +User
0 Karma

JarrettM
Path Finder

Thank you!! I had no idea about the - vs _ issue or the need for ' ' vs " " quotes. I'll avoid those pesky hyphens from now on!

Perfect answer!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...