So I'm having trouble figuring this one out. Basically for example we have 1000 alarms per day and 100 readers in our office. This would be an average of 10 alarms per reader. My question is how would i put that into a search that gets the info for me? I'm fairly new to Splunk but here's what I have. However this returns no results.
index="index" EVDESCR="Alarm"
|stats avg(EVDESCR) by READERDESC
Hi
when you want to calculate avg, you must apply this to a numerical field not as string like you have here.
Here is example how to do it with stats eval combination https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions
You could found easily several other examples how todo it.
r. Ismo