https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299410#M3828 <P>Hi , thanks for your response, i tried what you gave above, but it did not give me the correct output.</P> <P>the output of Yes, Total and Compliance is below. its already updated. what i am trying is to get the average value of Compliance. if i do avg(compliance) i get a different value and if i do sum(yes)/sum(total)*100 for compliance i get a different value, which is the correct one.</P> <P>could you help me get the correct average from this table using stats or any other way.</P> <P>Yes Total Compliance<BR /> 0 1 0<BR /> 0 4 0<BR /> 1 1 100<BR /> 224 225 99.56<BR /> 5 5 100<BR /> 15 15 100<BR /> 88 92 95.65</P> Fri, 30 Mar 2018 16:01:17 GMT jiaqya 2018-03-30T16:01:17Z https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299408#M3826 <P>i have numbers in Yes and Total columns and am trying to get a result using stats . but i keep getting error. not sure how to do this, can you help.</P> <P>|stats eval(Yes/Total)*100 as Compliance </P> <P>Error in 'stats' command: The aggregation specifier 'eval(Yes/Total)*100' is invalid. The aggregation specifier must be in <A href="https://community.splunk.com/%5Bkey%5D">func_name</A> format.</P> Fri, 30 Mar 2018 15:37:36 GMT https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299408#M3826 jiaqya 2018-03-30T15:37:36Z https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299409#M3827 <P>you cannot use <CODE>eval</CODE> inside of a <CODE>stats</CODE> command like that. try forming it more like this<BR /> <CODE>|eval Compliance=(Yes/Total)*100)|stats values(Compliance) as Compliance</CODE></P> Fri, 30 Mar 2018 15:53:59 GMT https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299409#M3827 cmerriman 2018-03-30T15:53:59Z https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299410#M3828 <P>Hi , thanks for your response, i tried what you gave above, but it did not give me the correct output.</P> <P>the output of Yes, Total and Compliance is below. its already updated. what i am trying is to get the average value of Compliance. if i do avg(compliance) i get a different value and if i do sum(yes)/sum(total)*100 for compliance i get a different value, which is the correct one.</P> <P>could you help me get the correct average from this table using stats or any other way.</P> <P>Yes Total Compliance<BR /> 0 1 0<BR /> 0 4 0<BR /> 1 1 100<BR /> 224 225 99.56<BR /> 5 5 100<BR /> 15 15 100<BR /> 88 92 95.65</P> Fri, 30 Mar 2018 16:01:17 GMT https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299410#M3828 jiaqya 2018-03-30T16:01:17Z https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299411#M3829 <P>how about something like this?<BR /> <CODE>...|addcoltotals labelfield=Compliance|search Compliance="Total"|eval Compliance=(Yes/Total)*100</CODE></P> <P>i put your data in this table so you can see what i did:</P> <PRE><CODE>|makeresults|eval data="Yes=0,Total=1,Compliance=0 Yes=0,Total=4,Compliance=0 Yes=1,Total=1,Compliance=100 Yes=224,Total=225,Compliance=99.56 Yes=5,Total=5,Compliance=100 Yes=15,Total=15,Compliance=100 Yes=88,Total=92,Compliance=99.65"|makemv data|mvexpand data|rename data as _raw|kv|table Yes Total Compliance|addcoltotals labelfield=Compliance|search Compliance="Total"|eval Compliance=(Yes/Total)*100 </CODE></PRE> Fri, 30 Mar 2018 16:31:05 GMT https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299411#M3829 cmerriman 2018-03-30T16:31:05Z https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299412#M3830 <P>it did help me . thanks</P> Sat, 31 Mar 2018 21:16:00 GMT https://community.splunk.com/t5/Splunk-Dev/getting-error-with-stats/m-p/299412#M3830 jiaqya 2018-03-31T21:16:00Z