Splunk Search

AVG command with WHERE statement

Marco_Develops
Path Finder

Hello All,

 

I am trying to calculate the Average of a column, but i want it to ignore all values that are equal to 0.

 

This currently what I have right now: 

 

stats avg(ComplianceScore) as CS by GeoLocation

 

But I need it to calculate AVG only if Compliance Score is not Zero. 

 

Thank you,

Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Set the zeros to null so they aren't included in the average

| eval ComplianceScore=if(ComplianceScore==0,null(),ComplianceScore)
| stats avg(ComplianceScore) as CS by GeoLocation

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Set the zeros to null so they aren't included in the average

| eval ComplianceScore=if(ComplianceScore==0,null(),ComplianceScore)
| stats avg(ComplianceScore) as CS by GeoLocation

 

Marco_Develops
Path Finder

Thank you! Exactly What I needed... Very clever. 😀 @ITWhisperer 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you'll have to create a custom command to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...