Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do you aggregate two types of data?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does aggregate mean using (sum, average, count etc) or does it mean something else? Please give an example on how to aggregate two types of data.
I'm using Splunk Search and Reporting (search query only)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
You can check the below link on aggregate functions and how to use those functions in splunk
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Aggregatefunctions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
You can check the below link on aggregate functions and how to use those functions in splunk
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Aggregatefunctions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you! If i have two different sources is it possible to aggregate those two togther and let's say find the average for both of them ? Or i have to find the average of each of them seperatly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes , it is possible to aggregate those two together and find the average for both of them
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you! do you have an example please ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"aggregate" depends on what you are trying to find out:
can be used with | stats or | chart for example:
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/CommonStatsFunctions#Supported_fun...
or with | eval for example:
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/MathematicalFunctions
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/StatisticalFunctions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you provide sample data and search string?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data i have are xml files and lookup tables. I just want an explannation of what aggregate two data types mean. Thanks!
[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
