Splunk Search

AVG command with WHERE statement

Marco_Develops
Path Finder

Hello All,

 

I am trying to calculate the Average of a column, but i want it to ignore all values that are equal to 0.

 

This currently what I have right now: 

 

stats avg(ComplianceScore) as CS by GeoLocation

 

But I need it to calculate AVG only if Compliance Score is not Zero. 

 

Thank you,

Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Set the zeros to null so they aren't included in the average

| eval ComplianceScore=if(ComplianceScore==0,null(),ComplianceScore)
| stats avg(ComplianceScore) as CS by GeoLocation

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Set the zeros to null so they aren't included in the average

| eval ComplianceScore=if(ComplianceScore==0,null(),ComplianceScore)
| stats avg(ComplianceScore) as CS by GeoLocation

 

Marco_Develops
Path Finder

Thank you! Exactly What I needed... Very clever. 😀 @ITWhisperer 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you'll have to create a custom command to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...