https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391596#M114004 <P>Hi @hyperscaleau</P> <P>try like this </P> <PRE><CODE>index=.................| streamstats window=10 earliest(SG) as SGStart | stats avg(SGStart) as OG |appendcols [search index=........| streamstats window=10 latest(SG) as SGEnd | stats avg(SGEnd) as FG] | eval stepG = 'OG'-'SG' | eval ABV=stepG*131.25 | table ABV </CODE></PRE> Tue, 25 Sep 2018 12:51:24 GMT harishalipaka 2018-09-25T12:51:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391595#M114003 <P>I need to return the average of the earliest 10 results <STRONG>(OG)</STRONG> in an index and the average of the latest 10 results <STRONG>(FG)</STRONG> in the same index. I then need to apply a calculation to get the result <STRONG>(ABV)</STRONG> -ie:</P> <PRE><CODE>ABV=[average of earliest 10 results] minus [average of the latest 10 results] multiplied by 131.25 </CODE></PRE> <P>I can calculate <STRONG>OG</STRONG> by using this search:</P> <PRE><CODE>| streamstats window=10 earliest(SG) as SGStart | stats avg(SGStart) as OG </CODE></PRE> <P>And I can calculate <STRONG>FG</STRONG> by using this search:</P> <PRE><CODE>| streamstats window=10 latest(SG) as SGEnd | stats avg(SGEnd) as FG </CODE></PRE> <P>And I can also calculate <STRONG>ABV</STRONG> by appending:</P> <PRE><CODE>| eval stepG = 'OG'-'SG' | eval ABV=stepG*131.25 | table ABV </CODE></PRE> <P>But obviously some events are lost in the pipeline due to filtering and I can't figure out how to put it all together.</P> <P>Any help would be greatly appreciated!</P> Tue, 25 Sep 2018 12:33:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391595#M114003 hyperscaleau 2018-09-25T12:33:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391596#M114004 <P>Hi @hyperscaleau</P> <P>try like this </P> <PRE><CODE>index=.................| streamstats window=10 earliest(SG) as SGStart | stats avg(SGStart) as OG |appendcols [search index=........| streamstats window=10 latest(SG) as SGEnd | stats avg(SGEnd) as FG] | eval stepG = 'OG'-'SG' | eval ABV=stepG*131.25 | table ABV </CODE></PRE> Tue, 25 Sep 2018 12:51:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391596#M114004 harishalipaka 2018-09-25T12:51:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391597#M114005 <P>Thanks @harishalipaka You're a star! Slight correction to due some typos (from my original post) but it works perfectly.</P> <PRE><CODE>index=xyz| streamstats window=10 earliest(SG) as SGStart | stats avg(SGStart) as OG |appendcols [search index=xyz | streamstats window=10 latest(SG) as SGEnd | stats avg(SGEnd) as FG] | eval stepG = 'OG'-'FG' | eval ABV = 'stepG'*131.25 | table OG,FG,ABV </CODE></PRE> Tue, 25 Sep 2018 13:17:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-the-average-of-the-first-10-results-to-the/m-p/391597#M114005 hyperscaleau 2018-09-25T13:17:15Z