Splunk Search

Advanced search for average and greater than

gagi76
New Member

Hi,

can someone point me to the advanced search. I need to search for transactions from current day that are greater than average from last month?
For now i have starting search for average from last month... and don't know how to proceed further.

earliest="04/01/2016:00:00:00" latest="04/30/2016:23:59:59" | stats avg(Price)
Tags (4)
0 Karma
1 Solution

somesoni2
Revered Legend

Something like this

index=yourindex sourcetype=yoursourcetype earliest=@d latest=now | where Price> [search index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon | stats avg(Price) as avg | return $avg ]  | table ..put required fields here...

View solution in original post

0 Karma

somesoni2
Revered Legend

Something like this

index=yourindex sourcetype=yoursourcetype earliest=@d latest=now | where Price> [search index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon | stats avg(Price) as avg | return $avg ]  | table ..put required fields here...
0 Karma

gagi76
New Member

Great, thanks! Actually it worked with this one:

yoursourcetype earliest=@d latest=now | where Price > [search  earliest=-1mon@mon latest=@mon | stats avg(Price) as avg | return $avg ]  | table ..put required fields here...
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...