Splunk Search

Average of unknown number of fields

helge
Builder

I have an unknown number of fields with similar names, e.g. field1, field2, field3, etc.

I need the average of all values from all fields. I tried to use a wildcard:

avg(field*)

But that gives me the averages of each field individually:

avg(field1) avg(field2) avg(field3) ...

This does not work either (no results):

avg(avg(field*))

Is there a way to get the average of all fields in a single value?

Tags (2)
1 Solution

lguinn2
Legend

Try this:

yoursearchhere
| stats sum(field*)  count(field*)
| addtotals fieldname=Sum sum*
| addtotals fieldname=Count count*
| eval Average = Sum / Count

I am not sure if it will work. I wasn't able to try it. But I think that the addtotals command will help.

View solution in original post

lguinn2
Legend

Try this:

yoursearchhere
| stats sum(field*)  count(field*)
| addtotals fieldname=Sum sum*
| addtotals fieldname=Count count*
| eval Average = Sum / Count

I am not sure if it will work. I wasn't able to try it. But I think that the addtotals command will help.

helge
Builder

Awesome, thanks!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...