https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467149#M131471 <P>this works thanks man</P> Tue, 07 Apr 2020 09:10:06 GMT zubairaizatron 2020-04-07T09:10:06Z https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467144#M131466 <P>How would i find the average value of a certain field per a certain amount of events</P> <P>Example:<BR /> i have 1000 events and in there i have a specific numerical field. what would i do if i wanted an average of every 10 events and wanted to display them in a new table. so my new table will have 100 events now each entry filled with the average of 10 events</P> Mon, 06 Apr 2020 13:34:44 GMT https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467144#M131466 zubairaizatron 2020-04-06T13:34:44Z https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467145#M131467 <P>Try this,</P> <PRE><CODE>index = INDEXNAME | streamstats count | eval count = count - 1, count = count - (count % 10) | stats avg(NUMERIC_FIELD) by count </CODE></PRE> Mon, 06 Apr 2020 14:36:14 GMT https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467145#M131467 manjunathmeti 2020-04-06T14:36:14Z https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467146#M131468 <P>This run-anywhere example may help.</P> <PRE><CODE>| makeresults | eval fielda = "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40" | eval fielda=split(fielda,",") | mvexpand fielda `comment("Everything above just creates sample data")` | streamstats reset_after=(count==10) window=10 avg(fielda) count | where count=10 | fields - count </CODE></PRE> Mon, 06 Apr 2020 14:44:55 GMT https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467146#M131468 richgalloway 2020-04-06T14:44:55Z https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467147#M131469 <P>this generates a weird count value. its goes 0,10,100,1000,10000,10010,10020,10030, whereas what we looking for is a 10,20,30,40,50 in the count</P> Mon, 06 Apr 2020 15:16:06 GMT https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467147#M131469 zubairaizatron 2020-04-06T15:16:06Z https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467148#M131470 <P>Just sort count, you'll see expected values:</P> <PRE><CODE>index = INDEXNAME | streamstats count | eval count = count - 1, count = count - (count % 10) | stats avg(NUMERIC_FIELD) by count | sort count </CODE></PRE> Mon, 06 Apr 2020 18:29:44 GMT https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467148#M131470 manjunathmeti 2020-04-06T18:29:44Z https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467149#M131471 <P>this works thanks man</P> Tue, 07 Apr 2020 09:10:06 GMT https://community.splunk.com/t5/Splunk-Search/average-for-a-field-value-per-n-number-of-events/m-p/467149#M131471 zubairaizatron 2020-04-07T09:10:06Z