topic Re: Showing mean() and avg() side by side in Splunk Search

Showing mean() and avg() side by side

Gunnar — Fri, 08 Oct 2021 09:56:36 GMT

Hi all,

strange thing - when using mean() and avg() in the same stats command, whichever is written first is empty, while the second value is shown with the correct result.

... | stats mean(Capacity) avg(Capacity)

mean(Capacity)	avg(Capacity)
	20.71428

... | stats avg(Capacity) mean(Capacity)

avg(Capacity)	mean(Capacity)
	20.71428

I know they are basically the same values. But why can't I show them side by side?

Each function on its own is working fine.

Also adding any of the other statistical functions is no problem, just avg() and mean() don't go together.

Why?

I'm on 8.2.0 at the moment.

Thank you very much and kind regards,

Gunnar

Re: Showing mean() and avg() side by side

Gunnar — Fri, 08 Oct 2021 10:02:08 GMT

For testing:

| makeresults | eval _raw="Date,Name,Capacity 2020-01-01,VM1,5 2020-01-02,VM2,5 2020-01-03,VM4,5 2020-01-04,VM1,10 2020-01-05,VM2,10 2020-01-06,VM4,10 2020-01-07,VM1,10 2020-01-08,VM2,10 2020-01-09,VM1,15 2020-01-10,VM2,15 2020-01-11,VM1,15 2020-01-12,VM2,15 2020-01-13,VM1,15 2020-01-14,VM2,20 2020-01-15,VM3,20 2020-01-16,VM1,20 2020-01-17,VM2,25 2020-01-18,VM3,25 2020-01-19,VM3,50 2020-01-20,VM3,55 2020-01-21,VM3,80 " | multikv forceheader=1 | eval _time=strptime(Date, "%Y-%m-%d") | fields Capacity | stats list(Capacity) min(Capacity) max(Capacity) avg(Capacity) median(Capacity) range(Capacity) mean(Capacity) stdev(Capacity) var(Capacity)

Re: Showing mean() and avg() side by side

PickleRick — Fri, 08 Oct 2021 14:07:27 GMT

From the job log:

10-08-2021 16:03:36.510 INFO  StatsProcessorV2 [10773 searchOrchestrator] - StatsProcessorV2::processArguments: Unaligned accesses are free
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function list for key=Capacity, alias=list(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function min for key=Capacity, alias=min(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function max for key=Capacity, alias=max(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function mean for key=Capacity, alias=avg(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function median for key=Capacity, alias=median(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function range for key=Capacity, alias=range(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Found existing Stats function  mean for key=Capacity alias changed to mean(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function stdev for key=Capacity, alias=stdev(Capacity)
10-08-2021 16:03:36.510 INFO  StatsAggregations [10773 searchOrchestrator] - Instantiating Stats function var for key=Capacity, alias=var(Capacity)

See the 3rd line from the bottom. Apparently Splunk notices that those two functions are equivalent to each other and decides it won't calculate values twice. Why it doesn't display the resulting value anyway beats me.

Re: Showing mean() and avg() side by side

ashvinpandey — Fri, 08 Oct 2021 14:15:20 GMT

@Gunnar Try using the below one:

| stats avg(Capacity) as Avg_Capacity mean(Capacity) as Mean_Capacity

| chart avg(Capacity) as Avg_Capacity mean(Capacity) as Mean_Capacity

Also, If this reply helps you, a thumbs-up would be appreciated.

Re: Showing mean() and avg() side by side

Gunnar — Fri, 08 Oct 2021 14:28:08 GMT

Hi,

first option doesn't make a difference - same result.

Using chart doesn't work either but returns an interesting error message:

"Error in 'chart' command: The specifier 'mean(Capacity)' is specified multiple times"

Which goes back to the reply from @PickleRick and what the log shows - apparently Splunk sees avg() and mean() as the same function and computes it only once in the same command.

Thank you,

Gunnar

Re: Showing mean() and avg() side by side

Gunnar — Fri, 08 Oct 2021 14:32:02 GMT

Thanks for looking at the logs.

So there actually is no separate avg() function - its just a fallback to mean().

That's not what I expected but probably explains it.

BR!

Gunnar

Re: Showing mean() and avg() side by side

ashvinpandey — Fri, 08 Oct 2021 14:33:18 GMT

@Gunnar Try this once:

| eventstats avg(Capacity) as Avg_Capacity | stats mean(Capacity) as Mean_Capacity | table Avg_Capacity Mean_Capacity