topic Re: How to work out average in Splunk Search

How to work out average

PaulaCom — Wed, 12 Jul 2023 11:32:40 GMT

Hi all

i have a search running with the following results

date_year count

2022 44,814

how do i get the average count over the year?

I've tried to eval date_year by 12 but this doesnt look right.

Also have | timechart avg(date_year) and this is not working out

any ideas?

Re: How to work out average

gcusello — Wed, 12 Jul 2023 11:57:53 GMT

Hi @PaulaCom,

if you have only one value it isn't possible to calculate the average.

Could you share your search?

Ciao.

Giuseppe

Re: How to work out average

ITWhisperer — Wed, 12 Jul 2023 12:00:21 GMT

What do you mean by average count over the year?

Is this average daily count over the year, or average weekly count, or average monthly count?

Whatever your time frame, you should calculate the counts for each month (for example) then take the average of these counts.

Re: How to work out average

PaulaCom — Wed, 12 Jul 2023 12:03:36 GMT

thank you

my search is pretty basic

index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json
| dedup id
| fillnull value=NULL

I've set the range to 'previous year'

there is also a field called date_month which shows the number of tickets raised over each month like this:

thanks

P:)

Re: How to work out average

gcusello — Wed, 12 Jul 2023 12:06:13 GMT

Hi @PaulaCom,

if you want the average for month, you could calculate:

index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json | stats count BY date_month | stats avg(count) AS avg

Ciao.

Giuseppe

Re: How to work out average

PaulaCom — Wed, 12 Jul 2023 12:07:22 GMT

thank you

i'm using data from 2022

the total number of calls to our helpdesk was 45k (ish)

and need to show the average calls we receive every month

so if i work that out in my head thats 45 / 12 = 3750 average number of calls per month

i'd like to work this out in Splunk

thank you

Re: How to work out average

PaulaCom — Wed, 12 Jul 2023 12:13:04 GMT

starbar!

thank you 🙂

Re: How to work out average

gcusello — Wed, 12 Jul 2023 12:14:27 GMT

Hi @PaulaCom ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: How to work out average

PaulaCom — Wed, 12 Jul 2023 12:20:41 GMT

thank you

I got a long number in my response 3759.4166666666665

so used the floor command to round it up !

thanks again for your guidance -

Re: How to work out average

ITWhisperer — Wed, 12 Jul 2023 12:27:40 GMT

The floor function rounds down not up; the ceil function will round up; the round function will round to the nearest number (with a specified level of precision).