topic appendpipe variable in Splunk Search

appendpipe variable

daktapaal — Thu, 30 Jan 2014 22:08:30 GMT

Hi Guys,

appendpipe [stats avg(*) as *], adds a new row with the average of all the rows of the respective column.
I wanted to get hold of this average value . So I didappendpipe [stats avg(*) as average(*)] . So that I can use the "average" as a variable . This is all fine. The issue is when i do the appendpipe [stats avg(*) as average(*)] , I get new columns added, with the names average(colname) and the row that existed before , with appendpipe [stats avg(*) as *] gets deleted..

How do I keep the averages row as it is , still be able to use average(*) , so that I can get the average value in a variable? is it possible?

Re: appendpipe variable

martin_mueller — Thu, 30 Jan 2014 23:24:49 GMT

I'm not quite sure I understand your question properly, so I'll take a stab in the dark. Are you trying to add horizontal average lines into a timechart?

If so, do something like this:

some search | timechart somethingorother | eventstats avg(*) as average(*)

That will add a field in the table / a line in your timechart graph called average(foo) for every field foo.

Re: appendpipe variable

martin_mueller — Fri, 31 Jan 2014 08:29:07 GMT

Now I'm sure I don't quite understand what you're ultimately trying to achieve.