Nesting a round function

[smileyge]

Say I want to calculate the average cost of spending on each SKU, say, by month. The AVG function by SKU works great, but I want to round every value in the resulting matrix to the nearest cent like so:

round(avg(TheCost),2) by ProductSku Month

That syntax doesn't work and I can't pipe it to another eval for the round like I could without the double attributes in the BY clause. After that operation that averages by month and Sku, I have a huge matrix of rows and coulmns and I can't figure out how to round each column and feed that list back into the round function and have it come out as a matrix again. Rounding before the average of course does not help. Thoughts? Is there a switch to set the default precision on a an average or something that might help?

[martin_mueller · Accepted solution]

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

[smileyge]

Nice, I didn't know to add the eval around the nested math, that did it!