https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403888#M167332 <P>[your search ] | eval purchaseprice = (item_no * unit_price) | eval total_items = sum(item_no) | eval totalpurchaseval = sum(purchaseprice) | eval averageitemprice= totalpurchaseval/total_items</P> Tue, 29 Sep 2020 23:30:48 GMT himpor 2020-09-29T23:30:48Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403882#M167326 <P>Hi Splunkers,<BR /> Suppose I have 2 values in my seach:</P> <P>Date, <STRONG># of items purchased, UnitPrice</STRONG><BR /> Day1, <STRONG>4, 0.12</STRONG><BR /> Day2, <STRONG>10, 0.10</STRONG><BR /> Day3, <STRONG>25, 0.19</STRONG><BR /> Day4, <STRONG>100, 0.15</STRONG></P> <P>I want to calculate the average item price throughout time. I hope this question makes sense.</P> <P>Cheers,</P> Mon, 01 Oct 2018 02:49:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403882#M167326 ADRIANODL 2018-10-01T02:49:54Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403883#M167327 <P>If you want avg for item price then try below-</P> <PRE><CODE>|eventstats avg(UnitPrice) as avg|eval avg=round(avg,2) </CODE></PRE> Mon, 01 Oct 2018 04:05:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403883#M167327 493669 2018-10-01T04:05:13Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403884#M167328 <P>Sorry but this doesn't solve my problem since the average I want to calculate is derived from # of items purchased AND UnitPrice.</P> Mon, 01 Oct 2018 09:05:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403884#M167328 ADRIANODL 2018-10-01T09:05:14Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403885#M167329 <P>@ADRIANODL, So what is the expected output?<BR /> like for <CODE># of items purchased</CODE>=4 and <CODE>UnitPrice</CODE>=0.12 then how avg is required to be calculated?</P> Mon, 01 Oct 2018 09:31:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403885#M167329 493669 2018-10-01T09:31:59Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403886#M167330 <P>Hi mate,<BR /> If for example, I buy 4 apples for 2 dollars each on day one, and 6 apples for 3 dollars each on day two, the average cost of my apples is calculated somehow like that:</P> <P>Total average is ((4 x$2) + (6 x $3))/(4+6) = 2.6 dollars average per apple.</P> <P>Now imagine I have X number of days, with different amounts of apples, and different value amounts).</P> <P>I'm having a hard time translating this equation into splunk commands.</P> Mon, 01 Oct 2018 12:50:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403886#M167330 ADRIANODL 2018-10-01T12:50:27Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403887#M167331 <P>try this run anywhere search-</P> <PRE><CODE>| makeresults |eval apple=4,price=2|append[| makeresults |eval apple=6,price=3]|eval product=apple*price|eventstats sum(apple) as sumApple, sum(product) as sumproduct|eval avg=sumproduct/sumApple|fields apple price avg </CODE></PRE> Mon, 01 Oct 2018 13:11:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403887#M167331 493669 2018-10-01T13:11:52Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403888#M167332 <P>[your search ] | eval purchaseprice = (item_no * unit_price) | eval total_items = sum(item_no) | eval totalpurchaseval = sum(purchaseprice) | eval averageitemprice= totalpurchaseval/total_items</P> Tue, 29 Sep 2020 23:30:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403888#M167332 himpor 2020-09-29T23:30:48Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403889#M167333 <P>base query <BR /> | eval purchase_price = (unit_price * no_of_items) <BR /> | stats avg(purchase_price) </P> Tue, 29 Sep 2020 23:29:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-moving-average-based-on-2-fields/m-p/403889#M167333 himpor 2020-09-29T23:29:40Z