https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700139#M237616 <P>Please explain, with some examples, what is in "statistics", what you mean by "first", "last" and "middle" and how this relates to the two averages that your stats command is returning.</P> Wed, 25 Sep 2024 20:48:37 GMT ITWhisperer 2024-09-25T20:48:37Z https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700138#M237615 <P>I have this query</P> <LI-CODE lang="markup">index=x host=y "searchTerm" | stats Avg(Field1) Avg(Field2)</LI-CODE> <P>which returns a count of N statistics.</P> <P>I would like modify my query such that</P> <LI-CODE lang="markup">(first stats value) statistics[0], (middle stats value) ((statistics[0]+statistics[N])/length(statistics)), (final stats value) statistics(N)</LI-CODE> <P>are returned in the same query</P> <P>I have tried using head and tail but that still limits it to the specified value after 'head' or 'tail'. What other options are available?</P> <P>&nbsp;</P> Wed, 25 Sep 2024 23:03:25 GMT https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700138#M237615 arkmenster 2024-09-25T23:03:25Z https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700139#M237616 <P>Please explain, with some examples, what is in "statistics", what you mean by "first", "last" and "middle" and how this relates to the two averages that your stats command is returning.</P> Wed, 25 Sep 2024 20:48:37 GMT https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700139#M237616 ITWhisperer 2024-09-25T20:48:37Z https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700144#M237618 <P>Thanks <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;. So in the screenshot below, we see that 170 statistics were returned. I would like the query to return the 1st, the 85th/86th, and the 170th statistic, instead of all 170 of them. Is there a way to accomplish this?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sample" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32811iAC4DB22E9D822D36/image-size/large?v=v2&amp;px=999" role="button" title="sample.png" alt="sample" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">sample</span></span></P> Wed, 25 Sep 2024 21:01:41 GMT https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700144#M237618 arkmenster 2024-09-25T21:01:41Z https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700146#M237619 <LI-CODE lang="markup">| streamstats count as row | eventstats max(row) as total | where row = 1 OR row = total OR row = floor(total / 2)</LI-CODE> Wed, 25 Sep 2024 21:37:11 GMT https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700146#M237619 ITWhisperer 2024-09-25T21:37:11Z https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700147#M237620 <P>Perfect. Thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>,&nbsp;your solution worked.</P> Wed, 25 Sep 2024 21:41:34 GMT https://community.splunk.com/t5/Splunk-Search/Return-top-middle-and-bottom-returns-from-query-results-using/m-p/700147#M237620 arkmenster 2024-09-25T21:41:34Z