Splunk Search

How to use round function in appendpipe?

JarrettM
Path Finder

This search works well and gives me the results I want as shown below:

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
    count(eval(responsestatus="200")) as success_count
    count(eval(responsestatus="503")) as failure_count 
    by User 
| appendpipe 
    [ stats avg(success_count) as avg-success_count 
    | eval User="Average Successes"] 
| appendpipe 
    [ stats avg(failure_count) as avg-failure_count 
    | eval User="Average Failures"]
| sort 0 +User

Sample results:

**User                success_count         failure_count               avg-failure_count   avg-success_count**
Average Failures                                                                        0.092400317 
Average Successes                                                                                                      135.6589156
user1                         106                          0        
user2                          88                          0        
etc.            

How do I round the values for avg-failure_count and avg-success_count? When I tried the following I got no result for avg-

success_count  and avg-failure_count.
| appendpipe 
    [ stats avg(success_count) as avg-success_count 
    | eval User="Average Successes"
     |eval avg-success_count=round(avg-success_count,2)] 
| appendpipe 
    [ stats avg(failure_count) as avg-failure_count 
    | eval User="Average Failures"
     |eval avg-failure_count=round(avg-failure_count,2)] 

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of 😃 and single quoted on expressions area, like this

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
count(eval(responsestatus="200")) as success_count
count(eval(responsestatus="503")) as failure_count 
by User 
| appendpipe 
[ stats avg(success_count) as avg-success_count 
| eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] 
| appendpipe 
[ stats avg(failure_count) as avg-failure_count 
| eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)]
| sort 0 +User

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Your field names contains special characters (hyphen) so they've to be double quoted in eval field assignment area(left side of 😃 and single quoted on expressions area, like this

index="index1" sourcetype="source_type1" responsestatus=200 OR responsestatus=503 
| eval User=lower(User)
| stats 
count(eval(responsestatus="200")) as success_count
count(eval(responsestatus="503")) as failure_count 
by User 
| appendpipe 
[ stats avg(success_count) as avg-success_count 
| eval User="Average Successes" | eval "avg-success_count"=round('avg-success_count',2)] 
| appendpipe 
[ stats avg(failure_count) as avg-failure_count 
| eval User="Average Failures" | eval "avg-failure_count"=round('avg-failure_count',2)]
| sort 0 +User
0 Karma

JarrettM
Path Finder

Thank you!! I had no idea about the - vs _ issue or the need for ' ' vs " " quotes. I'll avoid those pesky hyphens from now on!

Perfect answer!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...