Dashboards & Visualizations

Get average from multiple field in XML

yurykiselev
Path Finder

Hi!
I have XML-events with different name values:

<reactiontimes>
<rt1>1.42</rt1>
<rt2>1.31</rt2>
<rt3>1.33</rt3>
...
<rtN>X.XX</rtN>
</ractiontimes>

How can I get AVG of rt* for each event?
Thank you!

0 Karma
1 Solution

dineshraj9
Builder

Try this way -

index="dynavision" | streamstats count as event_count by _raw | rex max_match=0 "rt\d\>(?<REACTION_TIME>[\d\.]+)" | table _raw event_count REACTION_TIME | mvexpand REACTION_TIME | stats avg(REACTION_TIME) as AVG_REACTION_TIME by _raw event_count | fields - event_count | eval AVG_REACTION_TIME=round(AVG_REACTION_TIME,2)

View solution in original post

woodcock
Esteemed Legend

Try this:

Your Base Search Here | streamstats count AS serial | fields serial rt* | untable serial rt_stuff count | stats avg(count) BY serial

That gives the avg of the values inside of each event. From there you can easily get further averages across events.

0 Karma

dineshraj9
Builder

Try this way -

index="dynavision" | streamstats count as event_count by _raw | rex max_match=0 "rt\d\>(?<REACTION_TIME>[\d\.]+)" | table _raw event_count REACTION_TIME | mvexpand REACTION_TIME | stats avg(REACTION_TIME) as AVG_REACTION_TIME by _raw event_count | fields - event_count | eval AVG_REACTION_TIME=round(AVG_REACTION_TIME,2)

yurykiselev
Path Finder

Thank you!

0 Karma

yurykiselev
Path Finder

Found something:

index="dynavision" | eval rt_sum = 0 | eval rt_count = 0 | foreach modeBdata.red.reactiontimes.rt* [eval rt_count = rt_count + 1 | eval rt_sum = rt_sum + '<<FIELD>>' ] | eval rt_avg = rt_sum / rt_count

But it seems works only for first event((

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...