topic Re: Average Count doesn't show? in Splunk Search

Average Count doesn't show?

dbcase — Sat, 03 Sep 2016 02:24:33 GMT

Hi,

I have this query

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"|stats count avg(count) by host

And the results look like this

The count shows but no average count.... what am I missing?

Re: Average Count doesn't show?

somesoni2 — Sat, 03 Sep 2016 02:37:34 GMT

You can't use avg(count) as the field count is not available before stats. What you want to show in avg count?

Re: Average Count doesn't show?

dbcase — Sat, 03 Sep 2016 02:55:04 GMT

the average by day for each host

Re: Average Count doesn't show?

dbcase — Sat, 03 Sep 2016 02:57:47 GMT

I'm guessing the same applies for Trendline?

earliest=-45d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"|timechart  span=1d count by host| trendline sma2(count) as Trend

On this query I get the same count by host but no trendline

Re: Average Count doesn't show?

somesoni2 — Sat, 03 Sep 2016 03:05:20 GMT

Give this a try.

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"| bucket span=1d _time |stats count  by _time host | stats sum(count) as count avg(count) as avg by host

Replace avg with trend line for other requirement.

Re: Average Count doesn't show?

dbcase — Sat, 03 Sep 2016 03:08:44 GMT

Thanks somesoni2!!! Worked great!!!