Splunk Search

Average command vs count and average command

ranjitbrhm1
Communicator

Maybe im just bad in mathematics. but why does splunk docs always take the count of events and then the avg of events (stats count(events) | stats avg(events) instead of stats avg events directly?

can someone please explain the logic to me?

0 Karma
1 Solution

TISKAR
Builder

Hello,

The avg function applie to number field avg(event) the event is number, you can apply avg directly to the field that have the number value without use stats count, and when you use | stats count | stats avg the avg look only to the result give by stats count
For example:

 stats count as a by field | stats avg(a) 

can you share the link of docs please

Regards

View solution in original post

TISKAR
Builder

Hello,

The avg function applie to number field avg(event) the event is number, you can apply avg directly to the field that have the number value without use stats count, and when you use | stats count | stats avg the avg look only to the result give by stats count
For example:

 stats count as a by field | stats avg(a) 

can you share the link of docs please

Regards

FrankVl
Ultra Champion

Can you provide a link to an example of that? The way you quoted it here it doesn’t make too much sense to me...

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...