https://community.splunk.com/t5/Splunk-Search/Average-alarms-per-reader/m-p/544829#M154277 <P>Hi</P><P>when you want to calculate avg, you must apply this to a numerical field not as string like you have here.&nbsp;<BR />Here is example how to do it with stats eval combination&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions</A></P><P>You could found easily several other examples how todo it.</P><P>r. Ismo</P> Mon, 22 Mar 2021 21:15:40 GMT isoutamo 2021-03-22T21:15:40Z https://community.splunk.com/t5/Splunk-Search/Average-alarms-per-reader/m-p/544825#M154276 <P>So I'm having trouble figuring this one out. Basically for example we have 1000 alarms per day and 100 readers in our office. This would be an average of 10 alarms per reader. My question is how would i put that into a search that gets the info for me? I'm fairly new to Splunk but here's what I have. However this returns no results.&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index="index" EVDESCR="Alarm" |stats avg(EVDESCR) by READERDESC</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 22 Mar 2021 20:41:44 GMT https://community.splunk.com/t5/Splunk-Search/Average-alarms-per-reader/m-p/544825#M154276 msage 2021-03-22T20:41:44Z https://community.splunk.com/t5/Splunk-Search/Average-alarms-per-reader/m-p/544829#M154277 <P>Hi</P><P>when you want to calculate avg, you must apply this to a numerical field not as string like you have here.&nbsp;<BR />Here is example how to do it with stats eval combination&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions</A></P><P>You could found easily several other examples how todo it.</P><P>r. Ismo</P> Mon, 22 Mar 2021 21:15:40 GMT https://community.splunk.com/t5/Splunk-Search/Average-alarms-per-reader/m-p/544829#M154277 isoutamo 2021-03-22T21:15:40Z