Getting Data In

How can I split my data to show the average based on column values?

angersleek
Path Finder

I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to be getting a total value instead of a proper split.

Expected outcome: (I am open to ideas if there is a better way of displaying this)

average      maximum         minimum            environment        app_name
10           100             2                  env 1              service 1
12           180             3                  env 1              service 2
13           110             22                 env 1              service 3
34           100             21                 env 1              service 4
66           290             0                  env 1              service 5

10           100             2                  env 2              service 1
12           180             3                  env 2              service 2
13           110             22                 env 2              service 3
34           100             21                 env 2              service 4
66           290             0                  env 2              service 5

Actual outcome

average     maximum         minimum             environment        app_name
134         100             12                  env 1              service 1
                                                env 2              service 2
                                                                   service 3 
                                                                   service 4
                                                                   service 5

Search used:

some_search=* environment=* some_time=* | chart avg(some_time) as average, max(some_time) as maximum, min(some_time) as minimum, values(environment) as environment, values(app_name)
0 Karma
1 Solution

whrg
Motivator

Hi! Use the stats command along with the by clause when charting over multiple fields.

Try it like this:

| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name

View solution in original post

whrg
Motivator

Hi! Use the stats command along with the by clause when charting over multiple fields.

Try it like this:

| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name

angersleek
Path Finder

Perfect. Thanks.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...