Splunk Search

## Average command vs count and average command

Communicator

Maybe im just bad in mathematics. but why does splunk docs always take the count of events and then the avg of events `(stats count(events) | stats avg(events) instead of stats avg events` directly?

can someone please explain the logic to me?

Tags (4)
1 Solution
Builder

Hello,

The avg function applie to number field `avg(event)` the event is number, you can apply avg directly to the field that have the number value without use stats count, and when you use `| stats count | stats avg` the avg look only to the result give by `stats count`
For example:

`````` stats count as a by field | stats avg(a)
``````

Regards

Builder

Hello,

The avg function applie to number field `avg(event)` the event is number, you can apply avg directly to the field that have the number value without use stats count, and when you use `| stats count | stats avg` the avg look only to the result give by `stats count`
For example:

`````` stats count as a by field | stats avg(a)
``````