Splunk Search

Average of stats two fields values

paragvidhi
Engager

I have Below Splunk query to get some data from my logs

index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As "Total Records", sum(TotalTime_Taken) As "Total Time Taken" by Content

Below is the result of the above query

Content_Type            Total Records         Total Time Taken
==========              =============          ===========
Documents                   13                     25
Blogs                       25                    120
Events                      2                       5  

I want another column in my result Average_time_taken

Average_time_taken = Total Time Taken / Total Records

The result should be as below

Content_Type            Total Records         Total Time Taken                Average_time_taken
    ==========              =============          ===========               ====================
    Documents                   13                     25                          1.9230
    Blogs                       25                    120                          4.8
    Events                      2                       5                          2.5
Tags (1)
0 Karma

acfecondo75
Path Finder

You can just do an eval to create the new field. The only trick is that the field names within the eval statement will need to be in either single quotes or dollar signs to indicate to Splunk that you're referencing fields

| eval Average_time_taken='Total Time Taken'/'Total Records'
0 Karma

paragvidhi
Engager

it doesn't work for me, I need to use data that I got from stats result, and based on that result I need Average_time_taken.

0 Karma

acfecondo75
Path Finder

I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results.

Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work.

0 Karma

to4kawa
Ultra Champion
index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As T, sum(TotalTime_Taken) As TT by Content
| eval Average_time_taken= TT / T
| rename T as "Total Records" , TT as "Total Time Taken", Content as Content_Type
| table  Content_Type "Total Records" "Total Time Taken" Average_time_taken

Have you try @acfecondo75 recommend like this?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...