https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362865#M169984 <P>Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?</P> Wed, 25 Apr 2018 21:44:01 GMT dwong2 2018-04-25T21:44:01Z https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362862#M169981 <P>I have data similiar to this:</P> <P>Account Count TotalSessions<BR /> abc 4 12<BR /> xyz 2 12<BR /> zzz 6 12</P> <P>..search | stats count by Account | eventstats sum(count) as TotalSessions </P> <P>How do I get the calculation for TotalSessions/ # of Accounts? i.e. 12 divided by 3 in this example.</P> Wed, 25 Apr 2018 20:20:15 GMT https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362862#M169981 dwong2 2018-04-25T20:20:15Z https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362863#M169982 <P>Like this</P> <PRE><CODE>..search | stats count by Account | eventstats sum(count) as TotalSessions dc(Account) as TotalAccounts | eval AvgSessionPerAccount=TotalSessions/TotalAccounts </CODE></PRE> Wed, 25 Apr 2018 20:26:55 GMT https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362863#M169982 somesoni2 2018-04-25T20:26:55Z https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362864#M169983 <P>Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?</P> Wed, 25 Apr 2018 21:41:02 GMT https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362864#M169983 dwong2 2018-04-25T21:41:02Z https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362865#M169984 <P>Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?</P> Wed, 25 Apr 2018 21:44:01 GMT https://community.splunk.com/t5/Splunk-Search/Calculation-using-the-number-of-events-returned-to-determine/m-p/362865#M169984 dwong2 2018-04-25T21:44:01Z