https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/600561#M209064 <P>I did found an better way to do this.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval value = "1.2 2.5 0.5" | makemv value | mvexpand value | eval count=1 | addcoltotals | eval value=if(count&gt;1,value/count,value) | fields - count</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Result</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">_time value 2022-06-04 10:08:55 1.2 2022-06-04 10:08:55 2.5 2022-06-04 10:08:55 0.5 1.4</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Sat, 04 Jun 2022 08:30:27 GMT jotne 2022-06-04T08:30:27Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210063#M61435 <P>This one seems pretty straight forward, but I haven't been able to find an answer anywhere. I'm looking to calculate the average for all the values in a single column, kind of like addcoltotals. Example of what I am trying to achieve:</P> <PRE><CODE>User Time(Hours) user1 1.2 user2 2.0 user3 0.5 (average here) </CODE></PRE> Wed, 20 Apr 2016 13:38:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210063#M61435 jpolcari 2016-04-20T13:38:42Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210064#M61436 <P>You can do it like this</P> <PRE><CODE>yoursearchhere | stats sum(Time) as totalTime by User | appendpipe [ stats avg(totalTime) as totalTime | eval User = "Average Time" ] | rename totalTime as "Time (Hours)" </CODE></PRE> <P>The <CODE>appendpipe</CODE> commands examines the results in the pipeline, and in this case, calculates an average. The results of the <CODE>appendpipe</CODE> command are added to the end of the existing results. Notice that I used the same field names within the <CODE>appendpipe</CODE> command, so that the new results would align in the same columns.</P> Wed, 20 Apr 2016 14:01:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210064#M61436 lguinn2 2016-04-20T14:01:14Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210065#M61437 <P>Thank you! That is exactly what I needed.</P> Wed, 20 Apr 2016 14:06:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210065#M61437 jpolcari 2016-04-20T14:06:10Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210066#M61438 <P>You would think that there would be a "family" of commands similar to addcoltotals, such as addcolaverage...</P> Wed, 20 Apr 2016 14:52:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210066#M61438 ddrillic 2016-04-20T14:52:00Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210067#M61439 <P>That is what I was hoping for. Maybe one day!</P> Wed, 20 Apr 2016 14:57:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210067#M61439 jpolcari 2016-04-20T14:57:18Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210068#M61440 <P>I am trying to do something similar, but this solution is not working to me.<BR /> avg(totalTime) returns totalTime as it is the average of a single value. So I end up with a table for total times by user instead of the average by user. <BR /> I had to add the total number of occurrences and at the end divide the total value for the number of occurrences per user.</P> <P>rgds,<BR /> Juan</P> Fri, 10 Feb 2017 20:13:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/210068#M61440 jperezes 2017-02-10T20:13:26Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/600561#M209064 <P>I did found an better way to do this.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval value = "1.2 2.5 0.5" | makemv value | mvexpand value | eval count=1 | addcoltotals | eval value=if(count&gt;1,value/count,value) | fields - count</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Result</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">_time value 2022-06-04 10:08:55 1.2 2022-06-04 10:08:55 2.5 2022-06-04 10:08:55 0.5 1.4</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Sat, 04 Jun 2022 08:30:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-for-all-values-in-a-single-column/m-p/600561#M209064 jotne 2022-06-04T08:30:27Z