topic Re: Difference average and mean in Splunk Search

Difference average and mean

SilviaGebel — Thu, 09 Jul 2015 13:21:05 GMT

Hi,

as I can see in the Splunk docs, using | stats avg() and mean() shoud both give me the same results (arithmetic mean).

In my query I search for both of avg and mean. But I am only getting results for mean, not for average.
My search query is like this |index=x searchtype=x| stats avg() mean()

Why are there no results for average? Does average only work if Splunk automatically aggregates values for example to create the average of 5 min chunks? And mean takes all values and divides it by the total count?

Thank you!

Silvia

Re: Difference average and mean

acharlieh — Thu, 09 Jul 2015 13:54:26 GMT

There is indeed no difference between the two, however I've noticed that Splunk only spits out results for one of them when they are averaging the same field. (Which makes sense, since why do twice the work for the same result). For example this search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2 = value | stats avg(val2) mean(value)

Spits our values for both but this search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | stats avg(value) mean(value)

Spits out a value for only one of them

Re: Difference average and mean

woodcock — Thu, 09 Jul 2015 13:55:51 GMT

Is that your actual search? If so, the problem is that you need to tell Splunk what field to average by putting something inside the parentheses like this:

index=x sourcetype=x| stats avg(x) mean(x)

I have NEVER seen avg not work and I use it almost every day! If you are putting a field inside avg() then the answer is that the field you are telling Splunk to avg does not have any values for the search you are using.

Re: Difference average and mean

SilviaGebel — Thu, 09 Jul 2015 14:10:53 GMT

Oh - thank you. That makes sense.

Re: Difference average and mean

acharlieh — Thu, 09 Jul 2015 14:13:59 GMT

This isn't the problem. | stats avg is the same as | stats avg(*) which is spit out averages of all numeric fields. Example search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2=value | stats avg