https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434903#M168378 <P>This Search query is giving me result of Total and Average in seperate column. but i want Total and Average should get calculated below the fields column. For Eg: Total Time and Average Time should get calculated in the same Entry Time in ms column and Total Time and Average Time should get calculated in the same Exit Time in ms column. </P> <P>Is it possible? bcoz i tried with the above query that i have added but that does not gives the expected result for average.</P> Thu, 12 Jul 2018 12:23:17 GMT rajeswarir 2018-07-12T12:23:17Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434900#M168375 <PRE><CODE> IDS Entry Time in ms Exit Time in ms 1 30 40 2 15 10 3 05 11 4 10 05 5 08 09 Total Time 68 75 Average Time13.6 15 </CODE></PRE> <P>I want the result in the above way table data to be displayed i.e Total in one row to be calculated and average in one row to be calculated. But for me, it is displaying average by including total time as well so I am getting answer Average 27.2 for Entry Time and 30 for Exit time.</P> <P>Can anyone help me to get the average correctly by neglecting Total Time of Entry and Exit Time.</P> Wed, 11 Jul 2018 11:13:54 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434900#M168375 rajeswarir 2018-07-11T11:13:54Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434901#M168376 <P>This is the query i have used to get the result</P> <P>source="test.log" |table IDS,Entry Time in ms,Exit Time in ms|addcoltotals Entry Time in ms,Exit Time in ms,Total labelfield=IDS|addtotals Entry Time in ms Exit Time in ms|appendpipe[stats avg(*) as *|eval IDS="Average Time"]</P> Wed, 11 Jul 2018 12:35:07 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434901#M168376 rajeswarir 2018-07-11T12:35:07Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434902#M168377 <P>Hi @rajeswarir,</P> <P>Try this</P> <PRE><CODE>"your base search to list table" | appendpipe [stats sum("Entry Time in ms") as "Entry Time in ms",sum("Exit Time in ms") as "Exit Time in ms"|eval IDS="Total"] | appendpipe [stats avg("Entry Time in ms") as "Entry Time in ms",avg("Exit Time in ms") as "Exit Time in ms"|eval IDS="Average"] </CODE></PRE> Wed, 11 Jul 2018 12:50:31 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434902#M168377 renjith_nair 2018-07-11T12:50:31Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434903#M168378 <P>This Search query is giving me result of Total and Average in seperate column. but i want Total and Average should get calculated below the fields column. For Eg: Total Time and Average Time should get calculated in the same Entry Time in ms column and Total Time and Average Time should get calculated in the same Exit Time in ms column. </P> <P>Is it possible? bcoz i tried with the above query that i have added but that does not gives the expected result for average.</P> Thu, 12 Jul 2018 12:23:17 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434903#M168378 rajeswarir 2018-07-12T12:23:17Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434904#M168379 <P>Try like this</P> <PRE><CODE>source="test.log" |table IDS,Entry Time in ms,Exit Time in ms |appendpipe[| stats sum(*) as *|eval IDS="Total Time"] |appendpipe[where IDS!="Total Time" |stats avg(*) as *|eval IDS="Average Time" ] </CODE></PRE> Thu, 12 Jul 2018 16:08:30 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434904#M168379 somesoni2 2018-07-12T16:08:30Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434905#M168380 <P>Thanks. This is what i expected as a result.</P> Fri, 13 Jul 2018 04:27:44 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-average-after-calculating-the-total-for/m-p/434905#M168380 rajeswarir 2018-07-13T04:27:44Z