Splunk Search

eval round

slipinski
Path Finder

Hi all,

During evaluating round I got the error:
| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round("booking average time",2)

Error in 'eval' command: The arguments to the 'round' function are invalid.

Any ideas? Using inline search gives me the same result.

thanks
Szymon

Tags (3)
0 Karma
1 Solution

to4kawa
Ultra Champion

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

View solution in original post

0 Karma

to4kawa
Ultra Champion

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

0 Karma

slipinski
Path Finder

Thanks a lot!

0 Karma

shivanshu1593
Builder

Agreed. It's a nightmare to do the aggregation of the fields with spaces in it.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

shivanshu1593
Builder

May be this might help:

| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round(("booking average time"),2)
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

slipinski
Path Finder

The same result

0 Karma

shivanshu1593
Builder

Oh my bad. Please try this:

| stats avg(eval(round(duration,2))) AS "booking average time" by hours
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...