https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311516#M93357 <P>See above, the problem was related to &lt;&gt; values in ReqMonthAva.</P> <P>Tks!<BR /> Carmine</P> Fri, 19 Jan 2018 08:09:33 GMT CarmineCalo 2018-01-19T08:09:33Z https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311512#M93353 <P>Splunkers!</P> <P>I'm not able to solve a strange issue...</P> <P>Basically, the stats avg() is omitting values in the calculation.</P> <P>Code is the following:</P> <PRE><CODE>&lt;&lt;search&gt;&gt; | fillnull Incident_Duration,Unavailabilty_Month value=0 | stats avg(Incident_Duration) as Incident_Avg, avg(Unavailabilty_Month) as Unavailabilty_Avg by ReqMonthAva, AppID </CODE></PRE> <P>So, null value are transformed into 0 in the table resulting from the previous search, but avg function is not considering them while processing Incident_Avg and Unavailabilty_Avg</P> <P>Seems to me very strange... how can i solve?</P> <P>Tks in advance!</P> Tue, 29 Sep 2020 17:41:13 GMT https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311512#M93353 CarmineCalo 2020-09-29T17:41:13Z https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311513#M93354 <P>can you try </P> <PRE><CODE> &lt;&lt;search&gt;&gt; | fillnull | stats avg(Incident_Duration) as Incident_Avg, avg(Unavailabilty_Month) as Unavailabilty_Avg by ReqMonthAva, AppID </CODE></PRE> Thu, 18 Jan 2018 18:54:07 GMT https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311513#M93354 mayurr98 2018-01-18T18:54:07Z https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311514#M93355 <P>can you try:</P> <PRE><CODE> ..|eval Incident_Duration=tonumber(Incident_Duration), Unavailabilty_Month=tonumber(Unavailabilty_Month) | fillnull Incident_Duration,Unavailabilty_Month value=0 | stats avg(Incident_Duration) as Incident_Avg, avg(Unavailabilty_Month) as Unavailabilty_Avg by ReqMonthAva, AppID </CODE></PRE> <P>i think it might be that your values are strings and not numbers. using this runanywhere command: <CODE>|makeresults|eval data=" ,2,1,4,6"|makemv delim="," data|mvexpand data|eval with_zero=tonumber(data)|fillnull with_zero value=0|stats avg(data) avg(with_zero)</CODE>, the values are different.</P> Thu, 18 Jan 2018 19:20:10 GMT https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311514#M93355 cmerriman 2018-01-18T19:20:10Z https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311515#M93356 <P>It works!</P> <P>I found the root problem... basically RegMonthAva had some &lt;&gt; value (corresponding with &lt;&gt; values for Unavailability_month and Incident_Duration).</P> <P>With | fillnull i solve the problem.</P> <P>Tks!</P> <P>Carmine</P> Tue, 29 Sep 2020 17:41:32 GMT https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311515#M93356 CarmineCalo 2020-09-29T17:41:32Z https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311516#M93357 <P>See above, the problem was related to &lt;&gt; values in ReqMonthAva.</P> <P>Tks!<BR /> Carmine</P> Fri, 19 Jan 2018 08:09:33 GMT https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311516#M93357 CarmineCalo 2018-01-19T08:09:33Z https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311517#M93358 <P>I am glad that my solution helped you to get the desired results. I am converting my comment to an answer. Accept/upvote it if this is an answer to your question!</P> Fri, 19 Jan 2018 08:10:43 GMT https://community.splunk.com/t5/Splunk-Search/Include-zero-in-the-average/m-p/311517#M93358 mayurr98 2018-01-19T08:10:43Z