Splunk Search

Nesting a round function

smileyge
Path Finder

Say I want to calculate the average cost of spending on each SKU, say, by month. The AVG function by SKU works great, but I want to round every value in the resulting matrix to the nearest cent like so:

round(avg(TheCost),2) by ProductSku Month

That syntax doesn't work and I can't pipe it to another eval for the round like I could without the double attributes in the BY clause. After that operation that averages by month and Sku, I have a huge matrix of rows and coulmns and I can't figure out how to round each column and feed that list back into the round function and have it come out as a matrix again. Rounding before the average of course does not help. Thoughts? Is there a switch to set the default precision on a an average or something that might help?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

View solution in original post

smileyge
Path Finder

Nice, I didn't know to add the eval around the nested math, that did it!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.