https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75955#M19176 <P>Using Verbose mode in Splunk 5.0, or with Field Discovery ON in earlier versions, do you see the fields <CODE>example_time</CODE> and <CODE>example_method</CODE> in the gray fields box? What is the letter next to the name of the fields - "a" or "#"? If it is an "a", then Splunk thinks the field is alphanumeric. You might check the values, perhaps your new extraction is picking up non-numeric characters.</P> <P>Other ideas:<BR /><BR /> Are you sure the name is exactly the same? Field names are case sensitive.<BR /><BR /> Also, are the permissions on the new field extractions the same as the old field extractions?<BR /><BR /> Are the new field extractions in the same app as the old field extractions?<BR /><BR /> Apologies if you have checked these things already...</P> Wed, 02 Jan 2013 20:58:37 GMT lguinn2 2013-01-02T20:58:37Z https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75954#M19175 <P>Hi, <BR /> I have been running a stats query for months on a very basic search to great success. I recently had to change how the field extractions that I pull from the logs look. To do this I used the manager and deleted the old extraction and created a new one with the exact same name. Since then<BR /> all the other stats functions work fine, but average comes up blank. Average works fine for other event types and searches. I have tried restarting the box and clearing my browser cache. Did i irrevocably destroy averages for this sourcetype?</P> <P>This is the search i use <BR /> sourcetype="Example" | stats min(example_time), max(example_time), count(example_method), avg(example_time) by example_method </P> Mon, 28 Sep 2020 13:02:15 GMT https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75954#M19175 jericksonpf 2020-09-28T13:02:15Z https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75955#M19176 <P>Using Verbose mode in Splunk 5.0, or with Field Discovery ON in earlier versions, do you see the fields <CODE>example_time</CODE> and <CODE>example_method</CODE> in the gray fields box? What is the letter next to the name of the fields - "a" or "#"? If it is an "a", then Splunk thinks the field is alphanumeric. You might check the values, perhaps your new extraction is picking up non-numeric characters.</P> <P>Other ideas:<BR /><BR /> Are you sure the name is exactly the same? Field names are case sensitive.<BR /><BR /> Also, are the permissions on the new field extractions the same as the old field extractions?<BR /><BR /> Are the new field extractions in the same app as the old field extractions?<BR /><BR /> Apologies if you have checked these things already...</P> Wed, 02 Jan 2013 20:58:37 GMT https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75955#M19176 lguinn2 2013-01-02T20:58:37Z https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75956#M19177 <P>There is a # next to the name of the fields. The permissions and names are all the same.</P> Wed, 02 Jan 2013 21:57:28 GMT https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75956#M19177 jericksonpf 2013-01-02T21:57:28Z https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75957#M19178 <P>i just re created the example_time field and realized that it was grabbing the ms at the end of the values that are included in the logs now it is working again. </P> <P>Thanks for your help</P> Wed, 02 Jan 2013 22:02:42 GMT https://community.splunk.com/t5/Splunk-Search/stats-average-function-suddenly-blank/m-p/75957#M19178 jericksonpf 2013-01-02T22:02:42Z