topic Re: Missing Stats Data in Splunk Search

Missing Stats Data

jkwilling — Wed, 15 Sep 2021 18:39:42 GMT

When mean & avg are both present on a "stats" search, the first one in order will be missing so:

| makeresults count=100 | eval Value=random() % 100
| Stats count(Value) AS Count avg(Value) AS Avg mean(Value) AS Mean

results in:

Count	Avg	Mean
100		49.49

While

| makeresults count=100 | eval Value=random() % 100
| Stats count(Value) AS Count mean(Value) AS Mean avg(Value) AS Avg

results in:

Count	Mean	Avg
100		43.78

So why is one of the values missing?

John W.

Re: Missing Stats Data

richgalloway — Wed, 15 Sep 2021 18:56:57 GMT

mean() and avg() are the same so perhaps stats just takes the last one specified. If you only use one of those functions then you won't have any "missing" data. 😀

Re: Missing Stats Data

bowesmana — Wed, 15 Sep 2021 23:34:28 GMT

As @richgalloway says, mean and average are the same, so it's a pointless aggregation.

| makeresults count=100 | eval Value=random() % 100, Value2=Value | Stats count(Value) AS Count avg(Value2) AS Avg mean(Value) AS Mean

Making Value2 as Value, will give you both aggregations, but as you can see they are the same.

Re: Missing Stats Data

jkwilling — Thu, 16 Sep 2021 00:40:06 GMT

Now that you pointed it out, I should have know that Mean/Avg are the same....

I was just playing with extracting all of the aggregate functions and just noticed the conditions and thought that I would report it.

Thanks,

John