topic Re: Calculate avg , min , max for per multivalue field in Splunk Search

Calculate avg , min , max for per multivalue field

yuwtennis — Tue, 27 Aug 2013 05:26:46 GMT

Hi !

I would like to ask question whether following calculation is possible or not?
For following case,

customer type amount
A a 10
A a 20
A b 10
B a 5
B a 10

I want to calculate fields as

customer type count min max avg
A a 2 10 20 15
b 1 10 10 10
B a 2 5 10 7.5

However, I have tried that

stats values(type) , count, min(amount), max(amount), avg(amount) by customer

does not work...

I would appreciate if someone can help me out with this issue.

Thanks,
Yu

Re: Calculate avg , min , max for per multivalue field

HiroshiSatoh — Tue, 27 Aug 2013 05:39:20 GMT

The result is useless or in the following?Please let me know if there is something objective.

stats count, min(amount), max(amount), avg(amount) by customer,type
customer type count min max avg
A a 2 10 20 15
A b 1 10 10 10
B a 2 5 10 7.5

Re: Calculate avg , min , max for per multivalue field

yuwtennis — Tue, 27 Aug 2013 05:48:47 GMT

Hello Hiroshi.

My goal is to calculate the stats (max, min , avg) by type per customer.
I believe just simply specifying "by" statement in stats groups by
type regardless of customer.

So if something like ,

stats ( count by type ) by customer

can happen, I can achieve my goal.

Re: Calculate avg , min , max for per multivalue field

yuwtennis — Tue, 27 Aug 2013 05:51:10 GMT

customer 別に type の値を計算したいのですが、
どうもうまくいかないみたいで。。。もし、
解決方法をご教示いただけると幸いです。

Re: Calculate avg , min , max for per multivalue field

HiroshiSatoh — Tue, 27 Aug 2013 06:08:59 GMT

Hi. yuwtennis.I also love tennis.

もう少しバリエーションをふやして結果のイメージを提供してもらえませんか？

Could you provide an image of the result by increasing the variation a little more?

Re: Calculate avg , min , max for per multivalue field

rturk — Tue, 27 Aug 2013 06:37:41 GMT

Hi Yutennis,

Putting your data into a lookup tennis.csv:

customer,type,amount
A, a, 10
A, a, 20
A, b, 10
B, a, 5
B, a, 10

I used the search:

| inputlookup tennis.csv | stats count, max(amount), min(amount), avg(amount) by customer, type

Which gave me this:

Hope this of some help! 🙂

Re: Calculate avg , min , max for per multivalue field

rturk — Tue, 27 Aug 2013 06:43:23 GMT

Sorry I didn't see Hiroshi's earlier answer - please accept his answer 🙂

Re: Calculate avg , min , max for per multivalue field

yuwtennis — Wed, 28 Aug 2013 03:38:46 GMT

Hello Hiroshi.

回答ありがとうございます。

以下のような結果を出したいです。

ex1：
customer type amount
A a 10
A a 10
A a 10
A b 10
B b 20
B c 10
C a 10

res1：
customer type avg min max
A a 10 10 10
b 10 10 10
B b 20 20 20
c 10 10 10
C a 10 10 10

以上です。

Re: Calculate avg , min , max for per multivalue field

yuwtennis — Wed, 28 Aug 2013 03:41:06 GMT

Hello R.Turk.

Thank you for the reply.
I was not aware that you can specify multiple fields in stats!

The result came out the way I wanted .

Thanks
Yu

Re: Calculate avg , min , max for per multivalue field

HiroshiSatoh — Wed, 28 Aug 2013 04:16:03 GMT

これはもう解決したと思ってよいか？
Is it may be considered to have resolved this anymore?

サンプルに近いフォーマットならこんな感じになると思う。
I think to be a feeling that if format close to the sample.

･･･ | stats count as count, min(amount) as min, max(amount) as max, avg(amount) as avg by customer,type|stats list(type) as type,list(count) as count,list(min) as min,list(max) as max,list(avg) as avg by customer

Re: Calculate avg , min , max for per multivalue field

rturk — Wed, 28 Aug 2013 14:20:28 GMT

No problems Yu - Please accept Hiroshi's answer so other people can find the solution.

いいえ問題は - 他の人が解決策を見つけることができるように Hiroshi's の答えを受け入れてくださいませ

(Thanks Google translate!)