topic Re: Getting a wrong answer for the calculation of mean in splunk in Splunk Search

Getting a wrong answer for the calculation of mean in splunk

theouhuios — Fri, 26 Oct 2012 15:50:34 GMT

Hello

I am trying to calculate the mean of a field and it's strange that splunk cal the mean in a completely different manner.

week A B mean(B)
1 41 1290 0 0.000000
2 42 1372 82 82.000000
3 43 81 1291 1291.000000

As you can see above the value is kind of wrong. The command which I used was

sourcetype=incident record.affectedCI="xxxx"| eval week=tonumber(strftime(_time,"%U"))  | stats count by week | rename count as A |delta A as B | eval B=coalesce(B,0) | eval B = abs(B) | stats mean(B) by week A B

In my understanding of math it should have been (0+82+1291)/3 and it should have been the same value for all the weeks. Can anyone please let me know if I am missing something here.

Regards

theou

Re: Getting a wrong answer for the calculation of mean in splunk

sowings — Fri, 26 Oct 2012 15:54:16 GMT

stats evaluates per-event, grouping by your differentiators (the by-clause). Try eventstats. In this case, an example invocation would be like this (replace the stats command at the end of your search):

| eventstats mean(B)

Re: Getting a wrong answer for the calculation of mean in splunk

theouhuios — Fri, 26 Oct 2012 15:58:27 GMT

Ahaa.. Got it. I understand it now on why it messed it up. Thanks for the clarification.