topic Re: Calculate Average in same field in Splunk Search

Calculate Average in same field

nivethainspire_ — Fri, 27 Nov 2020 06:40:26 GMT

I like to take sum the "count" where "Core Content" field's first 2 max values, Finally divide them by total count.

For Example,

In this table, I want the below calculation to be implemented using Eval.

(2223+1794) / 4768, where 2223 - 1st max value of core content, 1794 - 2nd max value of core content , 4768 - total count.

How to calculate this using eval.

gcusello — Fri, 27 Nov 2020 07:13:15 GMT

let me understand: do you want to display values and percentage of the first two values?

if yes, try something like this:

Ciao.

Giuseppe

ITWhisperer — Fri, 27 Nov 2020 08:13:32 GMT

gcusello — Fri, 27 Nov 2020 08:20:59 GMT

if instead you want two values but the percentage respect all the values, you could use the top command:

your_search | top 2 "Core Content"

Ciao.

Giuseppe

nivethainspire_ — Fri, 27 Nov 2020 09:23:54 GMT

Thanks!. It works. Same way, I have to leave the first 2 max values and do the same for others. What should I do.

gcusello — Fri, 27 Nov 2020 09:26:30 GMT

good for you!

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated by all the contributors 😉

nivethainspire_ — Fri, 27 Nov 2020 10:26:46 GMT

I want to leave the top 2 and sum up others