Archive
Highlighted

appendpipe variable

Path Finder

Hi Guys,

appendpipe [stats avg(*) as *], adds a new row with the average of all the rows of the respective column.
I wanted to get hold of this average value . So I didappendpipe [stats avg(*) as average(*)] . So that I can use the "average" as a variable . This is all fine. The issue is when i do the appendpipe [stats avg(*) as average(*)] , I get new columns added, with the names average(colname) and the row that existed before , with appendpipe [stats avg(*) as *] gets deleted..

How do I keep the averages row as it is , still be able to use average(*) , so that I can get the average value in a variable? is it possible?

Tags (1)
0 Karma
Highlighted

Re: appendpipe variable

SplunkTrust
SplunkTrust

I'm not quite sure I understand your question properly, so I'll take a stab in the dark. Are you trying to add horizontal average lines into a timechart?

If so, do something like this:

some search | timechart somethingorother | eventstats avg(*) as average(*)

That will add a field in the table / a line in your timechart graph called average(foo) for every field foo.

0 Karma
Highlighted

Re: appendpipe variable

SplunkTrust
SplunkTrust

Now I'm sure I don't quite understand what you're ultimately trying to achieve.

0 Karma