Splunk Search

How to round stats average to 2 decimal places?

markthompson
Builder

Hello,
I have this:

stats count by opentime | stats avg(count)

and I want the average to be in 2dp.

Anyone have any suggestions?

Tags (4)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,2))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,2))) AS Avg_Count by something

esalesap
Path Finder

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)).

brettcave
Builder

very useful, thanks @damiensurat

0 Karma

lakromani
Builder

I downvoted this post because does not work, since it round the number before its averaged. It will not round the result. Look at this round((4+5)/2) is not the same as (round(4)+round(5))/2

0 Karma

bschandramohan
Engager

It didn't actually round the average for me. I think that rounds the count or a field value before applying the average.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is how I do it:

stats count by opentime | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) | ...
---
If this reply helps you, Karma would be appreciated.

gkanapathy
Splunk Employee
Splunk Employee

if you really like the name avg(count) I believe you can do it by quoting the name:

... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2)

damiensurat
Contributor

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command:
EG:
| stats avg(eval(round(count,0))) AS Avg_Count

[https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions]

damiensurat
Contributor

This especially works well when you are using a split by statement.
EG:
| stats avg(eval(round(count,0))) AS Avg_Count by something

0 Karma

gene_tien
Observer

This is great - is there an equivalent way to do with with mstats searches? This syntax doesn't seem to work. 

0 Karma

AdsicSplunk
New Member

Hi,

I have tried the above but this is not working for me. Could anyone please tell me why round function is not working for me.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...