Is it possible to round up average, max, and min values to 2 decimal places using eval, but without changing how a sparkline is displayed?

[bidahor13]

Is there a way to round up the average, max and min values to 2 decimal places - without disrupting the sparkline display format?

Here is my SPL :

....| transaction maxspan=4h counter  by host | stats  sparkline(avg(Value),30m) AS Trend_Processor_time avg(Value) AS AVG  min(Value) AS MIN  max(Value) AS MAX by host

[Gilberto_Castil · Accepted solution]

You could use an eval statement to and the round function to accomplish this. For example, you can try this search:

index="_internal" sourcetype=splunkd  eps="*" 
| stats sparkline(avg(eps),30m) AS trend_eps avg(eps) AS AVG min(eps) AS MIN max(eps) AS MAX by group 
| eval AVG=round(AVG,2) 
| eval MIN=round(MIN,2) 
| eval MAX=round(MAX,2)

--
This will produce the following:

What you cannot do is reassign the value of the trend_eps results after the stats statement.

The eval functions are documented here.

[bidahor13]

Nice!! Thanks for the feedback.