topic Re: Issue with the AVG however min and max work fine. in Splunk Search

Issue with the AVG however min and max work fine.

joe06031990 — Mon, 20 Jul 2020 17:22:46 GMT

Hello,

I am using the stats command however the AVG shows as being blank yet min and max works fine:

Index=index_ test source= “Test” host= “Testhost” |stats AVG(timetaken) as AVG

any help would be greatly appreciated 😀.

thanks

Re: Issue with the AVG however min and max work fine.

isoutamo — Mon, 20 Jul 2020 17:39:52 GMT

ensure that this field is numeric. You check if from left side panel, interesting fields and check if there is “#” or “a” before it. # means numeric and a means character. If it’s character then there could be a space before or after the number. This can solve e.g.

eval timetaken = tonumber(trim(timetaken))

r. Ismo

Re: Issue with the AVG however min and max work fine.

joe06031990 — Mon, 20 Jul 2020 18:31:52 GMT

Hi, the field is a character and has hours,minutes, seconds and milliseconds. I have tried your eval however still get the same results.

Re: Issue with the AVG however min and max work fine.

isoutamo — Mon, 20 Jul 2020 20:38:26 GMT

As the avg works only for numbers you must first convert your time field to numeric. You should use strptime with correct format string to numeric then calculate avg for it and in the last step you could convert it back to the time string with strftime function with correct format string. More about those functions https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/DateandTimeFunctions

r. Ismo

Re: Issue with the AVG however min and max work fine.

joe06031990 — Tue, 21 Jul 2020 09:01:07 GMT

Still having a bit of trouble with this the format is 00:00:00:000000?

thanks

Re: Issue with the AVG however min and max work fine.

isoutamo — Tue, 21 Jul 2020 11:33:54 GMT

Can you give some sample events?

Re: Issue with the AVG however min and max work fine.

isoutamo — Tue, 21 Jul 2020 13:00:25 GMT

You could convert this to epoch with next example:

Re: Issue with the AVG however min and max work fine.

joe06031990 — Tue, 21 Jul 2020 12:57:00 GMT

The field I need to find the adverge for is TimeTaken=00:00:00:0000000.

Re: Issue with the AVG however min and max work fine.

isoutamo — Tue, 21 Jul 2020 13:01:35 GMT

Updated my previous example with change . -> : Did it work now?