topic Average of ratio of two fields? in Splunk Search
https://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101142#M26123
<P>in source X, I have fields A and B. I want to find the average ratio of two fields per hour. Something like:</P>
<P><CODE>source=X * | stats avg(eval(A/B)) by date_hour</CODE></P>
<P>...which obviously doesn't work. It says I need to rename something or rather...</P>Thu, 12 May 2011 21:07:59 GMTtravispowell2011-05-12T21:07:59ZAverage of ratio of two fields?
https://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101142#M26123
<P>in source X, I have fields A and B. I want to find the average ratio of two fields per hour. Something like:</P>
<P><CODE>source=X * | stats avg(eval(A/B)) by date_hour</CODE></P>
<P>...which obviously doesn't work. It says I need to rename something or rather...</P>Thu, 12 May 2011 21:07:59 GMThttps://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101142#M26123travispowell2011-05-12T21:07:59ZRe: Average of ratio of two fields?
https://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101143#M26124
<P>Have you tried it like this:</P>
<PRE><CODE>source=X * | eval ratio=A/B | stats avg(ratio) by date_hour
</CODE></PRE>Thu, 12 May 2011 21:10:36 GMThttps://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101143#M26124Ron_Naken2011-05-12T21:10:36ZRe: Average of ratio of two fields?
https://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101144#M26125
<P>I feel like I do this so often. Yes I did try that, but you reminded me I needed to capitalize the fields. I'm <EM>positive</EM> splunk is case-sensitive.</P>Thu, 12 May 2011 21:12:24 GMThttps://community.splunk.com/t5/Splunk-Search/Average-of-ratio-of-two-fields/m-p/101144#M26125travispowell2011-05-12T21:12:24Z