topic Re: The avg function is unsupported or undefined in Splunk Enterprise

The avg function is unsupported or undefined

R15 — Mon, 30 Oct 2023 23:33:35 GMT

I was building a new search and started getting this error with various functions. I simplified my search down to something straight out of the documentation to make sure I wasn't missing something silly, but still get the error even with this:
index=* | eval c=avg(1, 2, 3)

What's going on?

Re: The avg function is unsupported or undefined

inventsekar — Tue, 31 Oct 2023 00:42:56 GMT

Hi @R15 .. this search runs fine actually. may we know your remaining portions of the search(after calculating the avg, how do you have handle the avg values?!?!)
if you provide a screenshot, that would be of great help, thanks.

Re: The avg function is unsupported or undefined

R15 — Tue, 31 Oct 2023 14:13:41 GMT

There is no other portion, running the same search as in your screenshot I get the error.

Re: The avg function is unsupported or undefined

R15 — Tue, 31 Oct 2023 22:47:24 GMT

@inventsekar apparently avg is not an eval function in my version of splunk. It's available with other things like chart and stats, but not eval. Something like this works however:
... | chart eval(avg(bytes) ...

Re: The avg function is unsupported or undefined

inventsekar — Wed, 01 Nov 2023 00:19:03 GMT

@R15 wrote:
There is no other portion, running the same search as in your screenshot I get the error.

Could you pls take a screenshot and attach for our reference, thanks.

Re: The avg function is unsupported or undefined

isoutamo — Wed, 01 Nov 2023 07:02:56 GMT

as @inventsekar said it should work without issues. Could you try this

| makeresults | eval c=avg(1, 2, 3) | table c

It should give to 2 to you.

When this is working and your current query didn't work, then you have some other issue in it.

You could check which Splunk version you have by click Help -> About on top bar.

r. Ismo

Re: The avg function is unsupported or undefined

R15 — Wed, 01 Nov 2023 15:37:14 GMT

@isoutamo @inventsekar

We'll be upgrading soon but until then I'm stuck.

Re: The avg function is unsupported or undefined

isoutamo — Thu, 02 Nov 2023 09:14:46 GMT

It seems that avg as an eval function has deployed at 8.1.0 (https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/StatisticalFunctions).