Splunk Search

eval round

slipinski
Loves-to-Learn Lots

Hi all,

During evaluating round I got the error:
| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round("booking average time",2)

Error in 'eval' command: The arguments to the 'round' function are invalid.

Any ideas? Using inline search gives me the same result.

thanks
Szymon

Tags (3)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

View solution in original post

0 Karma

slipinski
Loves-to-Learn Lots

Thanks a lot!

0 Karma

shivanshu1593
Contributor

Agreed. It's a nightmare to do the aggregation of the fields with spaces in it.

0 Karma

shivanshu1593
Contributor

May be this might help:

| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round(("booking average time"),2)
0 Karma

slipinski
Loves-to-Learn Lots

The same result

0 Karma

shivanshu1593
Contributor

Oh my bad. Please try this:

| stats avg(eval(round(duration,2))) AS "booking average time" by hours
0 Karma