https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479582#M134411 <P>try this instead:</P> <PRE><CODE>| eventstats sum(data) as sum_of_data dc(MAC_Address) as dc_of_MAC_Address | eval average = sum_of_data / dc_of_MAC_Address </CODE></PRE> Thu, 27 Feb 2020 01:11:03 GMT anmolpatel 2020-02-27T01:11:03Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479580#M134409 <P>I am trying to feed the results of (2) subsearches into and eval search.</P> <P>| eval Average=data/asstes [stats sum(data) | return $data] [stats count(MAC_Address) | retun $assets] </P> <P>there may bay a better way to do this... I need to sum of data divded by to total number of unique MAC addresses.</P> <P>Any help is appreciated.</P> Wed, 26 Feb 2020 22:38:47 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479580#M134409 ianpaquette 2020-02-26T22:38:47Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479581#M134410 <P>Can you post some sample data?</P> Thu, 27 Feb 2020 00:48:57 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479581#M134410 masonmorales 2020-02-27T00:48:57Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479582#M134411 <P>try this instead:</P> <PRE><CODE>| eventstats sum(data) as sum_of_data dc(MAC_Address) as dc_of_MAC_Address | eval average = sum_of_data / dc_of_MAC_Address </CODE></PRE> Thu, 27 Feb 2020 01:11:03 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-and-stats-together/m-p/479582#M134411 anmolpatel 2020-02-27T01:11:03Z