topic Average of stats two fields values in Splunk Search

Average of stats two fields values

paragvidhi — Wed, 30 Sep 2020 05:30:12 GMT

I have Below Splunk query to get some data from my logs

index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As "Total Records", sum(TotalTime_Taken) As "Total Time Taken" by Content

Below is the result of the above query

Content_Type            Total Records         Total Time Taken
==========              =============          ===========
Documents                   13                     25
Blogs                       25                    120
Events                      2                       5

I want another column in my result Average_time_taken

Average_time_taken = Total Time Taken / Total Records

The result should be as below

Content_Type            Total Records         Total Time Taken                Average_time_taken
    ==========              =============          ===========               ====================
    Documents                   13                     25                          1.9230
    Blogs                       25                    120                          4.8
    Events                      2                       5                          2.5

Re: Average of stats two fields values

acfecondo75 — Mon, 18 May 2020 17:04:07 GMT

You can just do an eval to create the new field. The only trick is that the field names within the eval statement will need to be in either single quotes or dollar signs to indicate to Splunk that you're referencing fields

| eval Average_time_taken='Total Time Taken'/'Total Records'

Re: Average of stats two fields values

paragvidhi — Wed, 30 Sep 2020 05:30:41 GMT

it doesn't work for me, I need to use data that I got from stats result, and based on that result I need Average_time_taken.

Re: Average of stats two fields values

to4kawa — Tue, 19 May 2020 14:07:07 GMT

index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As T, sum(TotalTime_Taken) As TT by Content
| eval Average_time_taken= TT / T
| rename T as "Total Records" , TT as "Total Time Taken", Content as Content_Type
| table  Content_Type "Total Records" "Total Time Taken" Average_time_taken

Have you try @acfecondo75 recommend like this?

Re: Average of stats two fields values

acfecondo75 — Wed, 20 May 2020 04:23:45 GMT

I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results.

Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work.