Getting Data In

How can I split my data to show the average based on column values?

angersleek
Path Finder

I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to be getting a total value instead of a proper split.

Expected outcome: (I am open to ideas if there is a better way of displaying this)

average      maximum         minimum            environment        app_name
10           100             2                  env 1              service 1
12           180             3                  env 1              service 2
13           110             22                 env 1              service 3
34           100             21                 env 1              service 4
66           290             0                  env 1              service 5

10           100             2                  env 2              service 1
12           180             3                  env 2              service 2
13           110             22                 env 2              service 3
34           100             21                 env 2              service 4
66           290             0                  env 2              service 5

Actual outcome

average     maximum         minimum             environment        app_name
134         100             12                  env 1              service 1
                                                env 2              service 2
                                                                   service 3 
                                                                   service 4
                                                                   service 5

Search used:

some_search=* environment=* some_time=* | chart avg(some_time) as average, max(some_time) as maximum, min(some_time) as minimum, values(environment) as environment, values(app_name)
0 Karma
1 Solution

whrg
Motivator

Hi! Use the stats command along with the by clause when charting over multiple fields.

Try it like this:

| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name

View solution in original post

whrg
Motivator

Hi! Use the stats command along with the by clause when charting over multiple fields.

Try it like this:

| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name

angersleek
Path Finder

Perfect. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...