https://community.splunk.com/t5/Splunk-Search/average-count-events/m-p/270153#M190036 <P>Eventstats is your friend. Assuming your fields are named IP and events:</P> <PRE><CODE>| eventstats avg(events) as avg_events | where events &lt; avg_events </CODE></PRE> Mon, 25 Jul 2016 12:10:08 GMT javiergn 2016-07-25T12:10:08Z https://community.splunk.com/t5/Splunk-Search/average-count-events/m-p/270152#M190035 <P>Hey guys.</P> <P>I need to know what ip have less events then avarage of all devices.</P> <P>for example:<BR /> ip events<BR /> 1.1.1.1 11<BR /> 2.2.2.2 10<BR /> 3.3.3.3 9<BR /> 4.4.4.4 1</P> <P>so average is 7.75 and i want to find ip 4.4.4.4</P> Mon, 25 Jul 2016 11:00:06 GMT https://community.splunk.com/t5/Splunk-Search/average-count-events/m-p/270152#M190035 Shark2112 2016-07-25T11:00:06Z https://community.splunk.com/t5/Splunk-Search/average-count-events/m-p/270153#M190036 <P>Eventstats is your friend. Assuming your fields are named IP and events:</P> <PRE><CODE>| eventstats avg(events) as avg_events | where events &lt; avg_events </CODE></PRE> Mon, 25 Jul 2016 12:10:08 GMT https://community.splunk.com/t5/Splunk-Search/average-count-events/m-p/270153#M190036 javiergn 2016-07-25T12:10:08Z