Splunk Search

Nesting a round function

smileyge
Path Finder

Say I want to calculate the average cost of spending on each SKU, say, by month. The AVG function by SKU works great, but I want to round every value in the resulting matrix to the nearest cent like so:

round(avg(TheCost),2) by ProductSku Month

That syntax doesn't work and I can't pipe it to another eval for the round like I could without the double attributes in the BY clause. After that operation that averages by month and Sku, I have a huge matrix of rows and coulmns and I can't figure out how to round each column and feed that list back into the round function and have it come out as a matrix again. Rounding before the average of course does not help. Thoughts? Is there a switch to set the default precision on a an average or something that might help?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

smileyge
Path Finder

Nice, I didn't know to add the eval around the nested math, that did it!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...