Splunk Search

## Nesting a round function

Path Finder

Say I want to calculate the average cost of spending on each SKU, say, by month. The AVG function by SKU works great, but I want to round every value in the resulting matrix to the nearest cent like so:

round(avg(TheCost),2) by ProductSku Month

That syntax doesn't work and I can't pipe it to another eval for the round like I could without the double attributes in the BY clause. After that operation that averages by month and Sku, I have a huge matrix of rows and coulmns and I can't figure out how to round each column and feed that list back into the round function and have it come out as a matrix again. Rounding before the average of course does not help. Thoughts? Is there a switch to set the default precision on a an average or something that might help?

Tags (3)
1 Solution
SplunkTrust

You can do the rounding straight away without additional piping, like this:

``````... | chart eval(round(avg(TheCost),2)) by ProductSku Month
``````

For doing more complicated things to fields with dynamic names and numbers, take a look at the `foreach` command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

SplunkTrust

You can do the rounding straight away without additional piping, like this:

``````... | chart eval(round(avg(TheCost),2)) by ProductSku Month
``````

For doing more complicated things to fields with dynamic names and numbers, take a look at the `foreach` command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

Path Finder

Nice, I didn't know to add the eval around the nested math, that did it!

.conf21 Now Fully Virtual!