Splunk Search

Nesting a round function

smileyge
Path Finder

Say I want to calculate the average cost of spending on each SKU, say, by month. The AVG function by SKU works great, but I want to round every value in the resulting matrix to the nearest cent like so:

round(avg(TheCost),2) by ProductSku Month

That syntax doesn't work and I can't pipe it to another eval for the round like I could without the double attributes in the BY clause. After that operation that averages by month and Sku, I have a huge matrix of rows and coulmns and I can't figure out how to round each column and feed that list back into the round function and have it come out as a matrix again. Rounding before the average of course does not help. Thoughts? Is there a switch to set the default precision on a an average or something that might help?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can do the rounding straight away without additional piping, like this:

... | chart eval(round(avg(TheCost),2)) by ProductSku Month

For doing more complicated things to fields with dynamic names and numbers, take a look at the foreach command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/foreach

smileyge
Path Finder

Nice, I didn't know to add the eval around the nested math, that did it!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...