Splunk Search

Average of stats two fields values

paragvidhi
Engager

I have Below Splunk query to get some data from my logs

index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As "Total Records", sum(TotalTime_Taken) As "Total Time Taken" by Content

Below is the result of the above query

Content_Type            Total Records         Total Time Taken
==========              =============          ===========
Documents                   13                     25
Blogs                       25                    120
Events                      2                       5  

I want another column in my result Average_time_taken

Average_time_taken = Total Time Taken / Total Records

The result should be as below

Content_Type            Total Records         Total Time Taken                Average_time_taken
    ==========              =============          ===========               ====================
    Documents                   13                     25                          1.9230
    Blogs                       25                    120                          4.8
    Events                      2                       5                          2.5
Tags (1)
0 Karma

acfecondo75
Path Finder

You can just do an eval to create the new field. The only trick is that the field names within the eval statement will need to be in either single quotes or dollar signs to indicate to Splunk that you're referencing fields

| eval Average_time_taken='Total Time Taken'/'Total Records'
0 Karma

paragvidhi
Engager

it doesn't work for me, I need to use data that I got from stats result, and based on that result I need Average_time_taken.

0 Karma

acfecondo75
Path Finder

I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results.

Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work.

0 Karma

to4kawa
Ultra Champion
index=myindex sourcetype=mysourcetype "search string" 
| stats sum(TotalRecords) As T, sum(TotalTime_Taken) As TT by Content
| eval Average_time_taken= TT / T
| rename T as "Total Records" , TT as "Total Time Taken", Content as Content_Type
| table  Content_Type "Total Records" "Total Time Taken" Average_time_taken

Have you try @acfecondo75 recommend like this?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!