How to create a search that finds the average of the last three bins?

kishan2356 — Tue, 05 Apr 2022 21:55:29 GMT

I have an search where I need to find the average of the last three bins. Example: On my time filter I select an range of 10:00 - 10:30. I need to find the average of ONLY the first three bins 581, 698, and 247. How can I create a search that does this?

On this dashboard I use an time picker so the search would need to be dynamic, as there would be new time inputs.

_time	Count
10:00	581
10:05	698
10:10	247
10:15	987
10:20	365
10:30	875

Re: How to create a search that finds the average of the last three bins?

bowesmana — Tue, 05 Apr 2022 23:31:07 GMT

How do you want to display that, as a single value somewhere or in the same table as your example. There are several ways to calculate that. Note that you mention both first and last - but imply earliest in your numbers.

Note that you can always make a base search if you have data in one dashboard panel that is used by another and add whatever you need to a post processing search for the average.

If you simply want the average of the 3 as a value somewhere, take the last two lines of this.

or as a rolling average of the 3 bins, use this instead of the last two lines above

| streamstats window=3 avg(Count) as AvgCount

If that doesn't help, please clarify how you want to use this value

topic How to create a search that finds the average of the last three bins? in Splunk Search

How to create a search that finds the average of the last three bins?

Re: How to create a search that finds the average of the last three bins?