Splunk Search

A Chart with Total values and then an average Value

malcolmtkelly
Explorer

So I have a some data that I've put into a chart. For the purposes of this question lets say the data is in the form "Username Purchases"

userA 400
userB 800
userA 150
userZ 900
userA 350
userB 700

How do I create a chart that charts total number of purchases for each user and then a average value across all users as the final column?

So far I have:

sourcetype=data | chart sum(purchases) by username

But I don't know how to average out and insert that last average value.

Tags (2)
0 Karma

HiroshiSatoh
Champion

But what if I use the APPEND?

sourcetype=data | chart avg(purchases) by username | append [search sourcetype=data |eval username="allUserAverage" |chart avg(purchases) by username ]

0 Karma

timmalos
Communicator

Try

sourcetype=data | eventstats sum(purchases) as total|stats sum(purchases) as sum by username|eval percent=(sum/total)

watsm10
Communicator

From my understanding of your question, would it just be like this?

sourcetype=data | chart sum(purchases), avg(purchases) by username
0 Karma

malcolmtkelly
Explorer

That's not quite what I'm looking for. I am looking for a bar chart but based on the data the feeding it, the chart would look like:

userAaverage = 300
userBaverage = 750
userZaverage = 900
allUserAverage = 550

So four columns in total

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...