topic Re: Getting averages from 2 columns in Splunk Search

Getting averages from 2 columns

dbcase — Tue, 23 Jan 2018 18:25:29 GMT

Hi,

I have a query that looks like this

index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration|rename duration as "Login Duration in Seconds" statscount as "Number of times the Login Duration Occurred"| appendpipe [stats count | where count=0]

It makes a table that shows this

What I'd like to to is get an average number of seconds for login duration but using both columns. Example

1 second occurred 16 times so 1 second would have to be counted 16 times in the average.

Thoughts?

Re: Getting averages from 2 columns

somesoni2 — Tue, 23 Jan 2018 18:39:27 GMT

Give this a try

 index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration| appendpipe [stats count | where count=0]
| eval noofsecs=statscount*duration | stats sum(noofsecs) as noofsecs sum(statscount) as totaloccurances | eval "Average number of secs per login"=round(noofsecs/totaloccurances,2)

Re: Getting averages from 2 columns

dbcase — Tue, 23 Jan 2018 18:44:58 GMT

Hey Somesoni2!

Very nice solution! Thank you! (Again)