Splunk Search

Average of stats two fields values

paragvidhi
Engager

I have Below Splunk query to get some data from my logs

index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As "Total Records", sum(TotalTime_Taken) As "Total Time Taken" by Content

Below is the result of the above query

Content_Type            Total Records         Total Time Taken
==========              =============          ===========
Documents                   13                     25
Blogs                       25                    120
Events                      2                       5  

I want another column in my result Average_time_taken

Average_time_taken = Total Time Taken / Total Records

The result should be as below

Content_Type            Total Records         Total Time Taken                Average_time_taken
    ==========              =============          ===========               ====================
    Documents                   13                     25                          1.9230
    Blogs                       25                    120                          4.8
    Events                      2                       5                          2.5
Tags (1)
0 Karma

acfecondo75
Path Finder

You can just do an eval to create the new field. The only trick is that the field names within the eval statement will need to be in either single quotes or dollar signs to indicate to Splunk that you're referencing fields

| eval Average_time_taken='Total Time Taken'/'Total Records'
0 Karma

paragvidhi
Engager

it doesn't work for me, I need to use data that I got from stats result, and based on that result I need Average_time_taken.

0 Karma

acfecondo75
Path Finder

I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results.

Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work.

0 Karma

to4kawa
Ultra Champion
index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As T, sum(TotalTime_Taken) As TT by Content
| eval Average_time_taken= TT / T
| rename T as "Total Records" , TT as "Total Time Taken", Content as Content_Type
| table  Content_Type "Total Records" "Total Time Taken" Average_time_taken

Have you try @acfecondo75 recommend like this?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...