https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454729#M166823 <P>You switch from saying sourcetype to saying source. These are two different things. Since the partial SPL you provided says source I'm going to run with that. You can always replace source with sourcetype and it will still work. </P> <P>This would get you the average number of emails per company name and source</P> <PRE><CODE>index=testing (source="source1" OR source="source2") | stats avg(Emails) as Average by companyName source </CODE></PRE> <P>You can then choose your visualization to determine the type of graph you want. </P> Mon, 29 Oct 2018 17:56:13 GMT kmaron 2018-10-29T17:56:13Z https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454728#M166822 <P>I have two different sourcetypes with same index name. Both sources they have emails and it shows the number of those emails. I would like to aggregate both sources and find the average of emails from both sources, represent that on graph. </P> <P>source="source1" source="source2" index=testing |stats avg(Emails) by companyName</P> <P>I'm using Splunk Enterprise(Search and Reporting) -&gt; making dashboards. Thank you in advance. </P> Mon, 29 Oct 2018 17:36:43 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454728#M166822 maryamchar 2018-10-29T17:36:43Z https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454729#M166823 <P>You switch from saying sourcetype to saying source. These are two different things. Since the partial SPL you provided says source I'm going to run with that. You can always replace source with sourcetype and it will still work. </P> <P>This would get you the average number of emails per company name and source</P> <PRE><CODE>index=testing (source="source1" OR source="source2") | stats avg(Emails) as Average by companyName source </CODE></PRE> <P>You can then choose your visualization to determine the type of graph you want. </P> Mon, 29 Oct 2018 17:56:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454729#M166823 kmaron 2018-10-29T17:56:13Z https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454730#M166824 <P>sorry i meant source. The above gave me the result of an average of one source and not combined. I want the average of both sources combined for emails by company. </P> Mon, 29 Oct 2018 18:07:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454730#M166824 maryamchar 2018-10-29T18:07:11Z https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454731#M166825 <P>You just need to remove source. </P> <PRE><CODE> index=testing (source="source1" OR source="source2") | stats avg(Emails) as Average by companyName </CODE></PRE> Mon, 29 Oct 2018 20:02:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454731#M166825 kmaron 2018-10-29T20:02:18Z https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454732#M166826 <P>Thank you! </P> Tue, 30 Oct 2018 14:33:34 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-compute-the-average-number-of-emails-contained-in-two/m-p/454732#M166826 maryamchar 2018-10-30T14:33:34Z