Splunk Search

Average of different field values

tunix
New Member

Hi There

I want a simple table-view, with following information:
Name of different views, how often they were requestet per month (average).

My search is looking like this:

index="idx_MYINDEX" | bin _time span=1d | stats count as Views by _time,View_Name | fields - count | sort -Views

Result:

TimeStamp ViewName Views (count)

Now i want an average of each different field value in View_Name (in this example, I tryed it for a timespan 1d - not month)

Can someone please help me? I've tryed with "| stats avg(View_Name) but it didn't do what I expected.

Thank you in advance!

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi tunix,

So here is our co-anser 🙂

MuS suggested this:

index="idx_MYINDEX" | bin _time span=1d | stats count as Views by _time,View_Name | timechart span=1d avg(Views) as avg_Views by View_Name

this should give you the result you expect

tunix replied and used this:
Thanks for help - this works for me..

index="idx_MYINDEX" | bin _time span=1d | stats count as Views by _time,View_Name | stats avg(Views) as avg_Views by View_Name | sort - Views

Cheers, MuS

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...