Splunk Search

eval round

slipinski
Path Finder

Hi all,

During evaluating round I got the error:
| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round("booking average time",2)

Error in 'eval' command: The arguments to the 'round' function are invalid.

Any ideas? Using inline search gives me the same result.

thanks
Szymon

Tags (3)
0 Karma
1 Solution

to4kawa
Ultra Champion

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

View solution in original post

0 Karma

to4kawa
Ultra Champion

use ' not "
If you want aggregate the fields, do not use the fieldname with spaces.

0 Karma

slipinski
Path Finder

Thanks a lot!

0 Karma

shivanshu1593
Builder

Agreed. It's a nightmare to do the aggregation of the fields with spaces in it.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

shivanshu1593
Builder

May be this might help:

| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round(("booking average time"),2)
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

slipinski
Path Finder

The same result

0 Karma

shivanshu1593
Builder

Oh my bad. Please try this:

| stats avg(eval(round(duration,2))) AS "booking average time" by hours
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...