https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193174#M55576 <P>thanks for the replay, the function EventStats shows the total of each line, but I have to expose it to a single service</P> <P>index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) range(ETms) by Service | eventstats avg(range(ETms)) | sort count | reverse</P> <P>Service1 122286 1 1113 1112 5120.341137<BR /> Service2 63534 4 11109 11105 5120.341137</P> Wed, 14 Jan 2015 15:18:39 GMT carlpier 2015-01-14T15:18:39Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193172#M55574 <P>Hello,<BR /> I am looking for a way to calculate the avg from the result of the range function.<BR /> Here is the simple base search which finds all values for exit_status:</P> <PRE><CODE>index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) avg(ETms) stdev(ETms) median(ETms) mode(ETms) range(ETms) perc99(ETms) by Service | sort count | reverse </CODE></PRE> <P>I have to calculate the avg from the result of “range(ETms)”</P> <P>Any help would be greatly appreciated.</P> <P>Thanks in advance</P> Wed, 14 Jan 2015 11:35:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193172#M55574 carlpier 2015-01-14T11:35:01Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193173#M55575 <P>Easiest way to do this is use <CODE>eventstats</CODE> to add it to your table:</P> <P><CODE>...your search... | eventstats avg(range(ETms))</CODE></P> Wed, 14 Jan 2015 14:47:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193173#M55575 aweitzman 2015-01-14T14:47:33Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193174#M55576 <P>thanks for the replay, the function EventStats shows the total of each line, but I have to expose it to a single service</P> <P>index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) range(ETms) by Service | eventstats avg(range(ETms)) | sort count | reverse</P> <P>Service1 122286 1 1113 1112 5120.341137<BR /> Service2 63534 4 11109 11105 5120.341137</P> Wed, 14 Jan 2015 15:18:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193174#M55576 carlpier 2015-01-14T15:18:39Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193175#M55577 <P><CODE>eventstats</CODE> <STRONG>is</STRONG> computing the average of every entry in <CODE>range(ETms)</CODE>, and adding that result in a new column to each entry. If that isn't what you want, can you please show what you want your result to look like?</P> <P>Also, when you do, please use the "code sample" button in the editor so that it looks like this, it will make it much easier to read:</P> <PRE><CODE>Service1 122286 1 1113 1112 5120.341137 Service2 63534 4 11109 11105 5120.341137 </CODE></PRE> Wed, 14 Jan 2015 15:24:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193175#M55577 aweitzman 2015-01-14T15:24:54Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193176#M55578 <P>I want to see the average of a single service, your solution is exposed in the grand total ( 5120.341137) for each service</P> Wed, 14 Jan 2015 15:41:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193176#M55578 carlpier 2015-01-14T15:41:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193177#M55579 <P>You already have the "average of a single service" in your initial post: <CODE>....avg(ETms)... by Service</CODE></P> <P>What do you believe you are missing?</P> Wed, 14 Jan 2015 15:45:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193177#M55579 aweitzman 2015-01-14T15:45:32Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193178#M55580 <P>Please show a table of what your results are now, and another table of what you want them to be. Please include column headers.</P> Wed, 14 Jan 2015 15:50:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-average-from-the-result-of-the-range/m-p/193178#M55580 aweitzman 2015-01-14T15:50:00Z