https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426909#M74808 <P>Hi! Use the <STRONG>stats</STRONG> command along with the <STRONG>by</STRONG> clause when charting over multiple fields.</P> <P>Try it like this:</P> <PRE><CODE>| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name </CODE></PRE> Mon, 10 Dec 2018 13:38:43 GMT whrg 2018-12-10T13:38:43Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426908#M74807 <P>I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to be getting a total value instead of a proper split. </P> <P>Expected outcome: (I am open to ideas if there is a better way of displaying this)</P> <PRE><CODE>average maximum minimum environment app_name 10 100 2 env 1 service 1 12 180 3 env 1 service 2 13 110 22 env 1 service 3 34 100 21 env 1 service 4 66 290 0 env 1 service 5 10 100 2 env 2 service 1 12 180 3 env 2 service 2 13 110 22 env 2 service 3 34 100 21 env 2 service 4 66 290 0 env 2 service 5 </CODE></PRE> <P>Actual outcome</P> <PRE><CODE>average maximum minimum environment app_name 134 100 12 env 1 service 1 env 2 service 2 service 3 service 4 service 5 </CODE></PRE> <P>Search used: </P> <PRE><CODE>some_search=* environment=* some_time=* | chart avg(some_time) as average, max(some_time) as maximum, min(some_time) as minimum, values(environment) as environment, values(app_name) </CODE></PRE> Mon, 10 Dec 2018 13:19:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426908#M74807 angersleek 2018-12-10T13:19:49Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426909#M74808 <P>Hi! Use the <STRONG>stats</STRONG> command along with the <STRONG>by</STRONG> clause when charting over multiple fields.</P> <P>Try it like this:</P> <PRE><CODE>| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name </CODE></PRE> Mon, 10 Dec 2018 13:38:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426909#M74808 whrg 2018-12-10T13:38:43Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426910#M74809 <P>Perfect. Thanks. </P> Mon, 10 Dec 2018 14:16:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-my-data-to-show-the-average-based-on-column/m-p/426910#M74809 angersleek 2018-12-10T14:16:50Z