topic Re: Average of the total count in Splunk Search

Average of the total count

krusovice — Mon, 12 Mar 2018 06:01:49 GMT

Hello all,

How can I get the average of the output as below?

Calculation is 40 + 20 + 50 / 3 = 36.6

REQUEST          ID          DURATION          AVERAGE
AAA              1122        40 seconds        36.6 seconds
BBB              3344        20 seconds
CCC              5566        50 seconds

Thanks.

Re: Average of the total count

493669 — Mon, 12 Mar 2018 06:17:07 GMT

Hi @krusovice,
try this:

...|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"

Try this run anywhere search:

|makeresults|eval REQUEST="AAA", DURATION="40 seconds"
|append[|makeresults|eval REQUEST="BBB", DURATION="20 seconds"]
|append[|makeresults|eval REQUEST="CCC", DURATION="50 seconds"]
|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"

Re: Average of the total count

deepashri_123 — Mon, 12 Mar 2018 06:19:05 GMT

Hey krusovoice,

You can try this run anywhere query:

| makeresults | eval Request="AAA BBB CCC" | makemv Request| mvexpand Request | appendcols [| makeresults | eval ID="1122 3344 5566" | makemv ID| mvexpand ID ] |  appendcols [| makeresults | eval Duration="40seconds 50seconds 20seconds" | makemv Duration| mvexpand Duration ] |rex field=Duration "(?P<Dur>\d+)"| eventstats avg(Dur) AS avgDur

OR you can add this to your query:
|rex field=Duration "(?P\d+)"| eventstats avg(Dur) AS avgDur

Let me know if this helps!!

Re: Average of the total count

krusovice — Mon, 12 Mar 2018 06:53:26 GMT

Thank you @493669 for the great helps! It's work well in my dashboard.

Re: Average of the total count

krusovice — Mon, 12 Mar 2018 06:58:49 GMT

Hi deepashri_123,

eventstats just make the trick! Thank you as always.

Re: Average of the total count

deepashri_123 — Thu, 15 Mar 2018 08:49:57 GMT

@krusovice,
Please Upvote the answer if that helped!!
Thanks!!