Say I want to calculate the average cost of spending on each SKU, say, by month. The AVG function by SKU works great, but I want to round every value in the resulting matrix to the nearest cent like so:
round(avg(TheCost),2) by ProductSku Month
That syntax doesn't work and I can't pipe it to another eval for the round like I could without the double attributes in the BY clause. After that operation that averages by month and Sku, I have a huge matrix of rows and coulmns and I can't figure out how to round each column and feed that list back into the round function and have it come out as a matrix again. Rounding before the average of course does not help. Thoughts? Is there a switch to set the default precision on a an average or something that might help?
You can do the rounding straight away without additional piping, like this:
... | chart eval(round(avg(TheCost),2)) by ProductSku Month
For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach
command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach
You can do the rounding straight away without additional piping, like this:
... | chart eval(round(avg(TheCost),2)) by ProductSku Month
For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach
command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach
Nice, I didn't know to add the eval around the nested math, that did it!