Splunk Search

How to use round function in appendpipe?

JarrettM
Path Finder

This search works well and gives me the results I want as shown below:

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
    count(eval(responsestatus="200")) as success_count
    count(eval(responsestatus="503")) as failure_count 
    by User 
| appendpipe 
    [ stats avg(success_count) as avg-success_count 
    | eval User="Average Successes"] 
| appendpipe 
    [ stats avg(failure_count) as avg-failure_count 
    | eval User="Average Failures"]
| sort 0 +User

Sample results:

**User                success_count         failure_count               avg-failure_count   avg-success_count**
Average Failures                                                                        0.092400317 
Average Successes                                                                                                      135.6589156
user1                         106                          0        
user2                          88                          0        
etc.            

How do I round the values for avg-failure_count and avg-success_count? When I tried the following I got no result for avg-

success_count  and avg-failure_count.
| appendpipe 
    [ stats avg(success_count) as avg-success_count 
    | eval User="Average Successes"
     |eval avg-success_count=round(avg-success_count,2)] 
| appendpipe 
    [ stats avg(failure_count) as avg-failure_count 
    | eval User="Average Failures"
     |eval avg-failure_count=round(avg-failure_count,2)] 

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of 😃 and single quoted on expressions area, like this

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
count(eval(responsestatus="200")) as success_count
count(eval(responsestatus="503")) as failure_count 
by User 
| appendpipe 
[ stats avg(success_count) as avg-success_count 
| eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] 
| appendpipe 
[ stats avg(failure_count) as avg-failure_count 
| eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)]
| sort 0 +User

View solution in original post

0 Karma

somesoni2
Revered Legend

Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of 😃 and single quoted on expressions area, like this

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
count(eval(responsestatus="200")) as success_count
count(eval(responsestatus="503")) as failure_count 
by User 
| appendpipe 
[ stats avg(success_count) as avg-success_count 
| eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] 
| appendpipe 
[ stats avg(failure_count) as avg-failure_count 
| eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)]
| sort 0 +User
0 Karma

JarrettM
Path Finder

Thank you!! I had no idea about the - vs _ issue or the need for ' ' vs " " quotes. I'll avoid those pesky hyphens from now on!

Perfect answer!

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...