Splunk Search

eval round

slipinski
Path Finder

Hi all,

During evaluating round I got the error:
| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round("booking average time",2)

Error in 'eval' command: The arguments to the 'round' function are invalid.

Any ideas? Using inline search gives me the same result.

thanks
Szymon

Tags (3)
0 Karma
1 Solution

to4kawa
Ultra Champion

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

View solution in original post

0 Karma

to4kawa
Ultra Champion

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

0 Karma

slipinski
Path Finder

Thanks a lot!

0 Karma

shivanshu1593
Builder

Agreed. It's a nightmare to do the aggregation of the fields with spaces in it.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

shivanshu1593
Builder

May be this might help:

| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round(("booking average time"),2)
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

slipinski
Path Finder

The same result

0 Karma

shivanshu1593
Builder

Oh my bad. Please try this:

| stats avg(eval(round(duration,2))) AS "booking average time" by hours
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...