https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294750#M160372 <P>Hi!</P> <PRE><CODE>... | streamstats count as SESSION by PATIENT_ID PROGRAM_NAME | chart values(AVG_RT) over SESSION by PROGRAM_NAME limit=0 SESSION 0 A 1 A-Rhythmical 2 Inhibition 3 Diff inhibition 4 Shifting 5 Attention __________________________________________________________________________________________________ 1 0.76 0.75 0.76 1.80 1.03 0.96 0.77 0.79 1.84 1.05 1.02 0.80 0.80 1.09 1.19 0.82 0.82 1.27 0.83 0.79 1.30 1.31 2 0.79 0.78 ... 0.75 </CODE></PRE> <P>"0 A", "1 A-Rhythmical" are PROGRAM_NAMEs i.e. the name of these fields are variable. I would like to get average of its multivalues for each program name by SESSION:</P> <PRE><CODE>SESSION 0 A 1 A-Rhythmical 2 Inhibition 3 Diff inhibition 4 Shifting 5 Attention __________________________________________________________________________________________________ 1 0.76 0.79 0.79 1.82 1.06 1.16 2 0.79 0.77 ... </CODE></PRE> Tue, 04 Jul 2017 09:53:06 GMT yurykiselev 2017-07-04T09:53:06Z https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294750#M160372 <P>Hi!</P> <PRE><CODE>... | streamstats count as SESSION by PATIENT_ID PROGRAM_NAME | chart values(AVG_RT) over SESSION by PROGRAM_NAME limit=0 SESSION 0 A 1 A-Rhythmical 2 Inhibition 3 Diff inhibition 4 Shifting 5 Attention __________________________________________________________________________________________________ 1 0.76 0.75 0.76 1.80 1.03 0.96 0.77 0.79 1.84 1.05 1.02 0.80 0.80 1.09 1.19 0.82 0.82 1.27 0.83 0.79 1.30 1.31 2 0.79 0.78 ... 0.75 </CODE></PRE> <P>"0 A", "1 A-Rhythmical" are PROGRAM_NAMEs i.e. the name of these fields are variable. I would like to get average of its multivalues for each program name by SESSION:</P> <PRE><CODE>SESSION 0 A 1 A-Rhythmical 2 Inhibition 3 Diff inhibition 4 Shifting 5 Attention __________________________________________________________________________________________________ 1 0.76 0.79 0.79 1.82 1.06 1.16 2 0.79 0.77 ... </CODE></PRE> Tue, 04 Jul 2017 09:53:06 GMT https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294750#M160372 yurykiselev 2017-07-04T09:53:06Z https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294751#M160373 <P>@yurykiselev, just change from <CODE>values(AVG_RT)</CODE> to <CODE>avg(AVG_RT)</CODE>. </P> <PRE><CODE>&lt;YourBaseSearch&gt; | chart avg(AVG_RT) over SESSION by PROGRAM_NAME limit=0 </CODE></PRE> Tue, 04 Jul 2017 12:32:12 GMT https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294751#M160373 niketn 2017-07-04T12:32:12Z https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294752#M160374 <P>So simple! Thank you!</P> Tue, 04 Jul 2017 12:45:17 GMT https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294752#M160374 yurykiselev 2017-07-04T12:45:17Z https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294753#M160375 <P>You were already there... Glad it worked!!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 04 Jul 2017 12:50:12 GMT https://community.splunk.com/t5/Splunk-Search/Getting-average-of-variable-name-fields/m-p/294753#M160375 niketn 2017-07-04T12:50:12Z