https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472829#M133082 <P>If you want to add additional columns with statistics, use eventstats:</P> <PRE><CODE>... | eventstats count sum(foo) avg(foo) </CODE></PRE> <P>If you just want the statistics, use stats:</P> <PRE><CODE>... | stats count sum(foo) avg(foo) </CODE></PRE> <P>I'm not sure what particular statistic you're asking for, so those two are just examples similar to the words you used.</P> Sat, 15 Feb 2020 23:34:16 GMT martin_mueller 2020-02-15T23:34:16Z https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472828#M133081 <P>The column to the right has a total of the percentage increase, but I would like to take that total and divide it by the number of rows that made the total.</P> <P>source="im_positions*.csv" sourcetype="stock-Positions:csv" <BR /> | dedup Symbol<BR /> | rename "Market Value" as mv<BR /> | rename "Estimated Gain_Loss" as egl<BR /> | rex field=mv mode=sed "s/,//"<BR /> | rex field=egl mode=sed "s/,//"<BR /> | rex field=Price mode=sed "s/,//"<BR /> | replace $* with * in Price<BR /> | replace $* with * in egl<BR /> | replace N/A with 0 in egl<BR /> | replace $* with * in mv<BR /> | replace <EM>.000 with * in Quantity<BR /> | eval originalprice = (mv - egl)/Quantity<BR /> | eval eglneg=egl<BR /> | replace -</EM> with * in eglneg<BR /> | replace $* with * in eglneg<BR /> | replace N/A with 0 in eglneg<BR /> | eval originalpriceneg = (mv)+(eglneg)</P> <PRE><CODE>| eval originalprice=if(isnull(originalprice), originalpriceneg, originalprice) | eval Percent = round(((Price - originalprice)/originalprice*100),0) | table Symbol Description Quantity originalprice Price egl mv Percent | rename originalprice as "Purchased Price" | rename Price as "Current Price" | rename mv as "Market Value" | rename Percent as "Percentage Increase" | rename egl as "Estimated Gain_Loss" | rename Quantity as "# of Shares" | addcoltotals | sort -"Estimated Gain_Loss" </CODE></PRE> <P><IMG src="https://community.splunk.com/storage/temp/283642-stocks.jpg" alt="alt text" /></P> Wed, 30 Sep 2020 04:12:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472828#M133081 ihaveasplunkacc 2020-09-30T04:12:56Z https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472829#M133082 <P>If you want to add additional columns with statistics, use eventstats:</P> <PRE><CODE>... | eventstats count sum(foo) avg(foo) </CODE></PRE> <P>If you just want the statistics, use stats:</P> <PRE><CODE>... | stats count sum(foo) avg(foo) </CODE></PRE> <P>I'm not sure what particular statistic you're asking for, so those two are just examples similar to the words you used.</P> Sat, 15 Feb 2020 23:34:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472829#M133082 martin_mueller 2020-02-15T23:34:16Z https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472830#M133083 <P>Thank you, but that is not exactly what I am looking for.</P> <P>Field=percentage with a value=.25<BR /> and the second value in the field<BR /> Field=percentage with a value=.50</P> <P>If I add them I get a total of .75, but I want to divide that total by the number of values added to make it. In this case it would be .75/2=.375</P> <P>So if I I have a column of percentages, I want to add them all up and then divide the total by the number of values that made the sum.</P> Sat, 15 Feb 2020 23:45:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472830#M133083 ihaveasplunkacc 2020-02-15T23:45:01Z https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472831#M133084 <P>So... an average?</P> Sat, 15 Feb 2020 23:59:14 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472831#M133084 martin_mueller 2020-02-15T23:59:14Z https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472832#M133085 <P>My bad. You were absolutely correct. <BR /> Thank you</P> Sun, 16 Feb 2020 00:12:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-all-the-values-in-a-column-to-get-the-total-and/m-p/472832#M133085 ihaveasplunkacc 2020-02-16T00:12:44Z