Splunk Search

Calculate average from two fields

BornConfused
Engager

My initial log looks something like:

The quick brown fox jumps over the lazy dog, and it jumped in 23092 seconds.

Trying to extract the number value and get an average. I have a query which extracts the 14th value, essentially a time field. This query works, but I am trying to get an average of the times per host.

| rex field=_raw "(\S+\s+){13}(?<processTime>\S+)\s"
| stats count by processTime, host

processTime                host
23092                             host123
45098                             host088
98987                             host238
23092                             host123
23092                             host123
98656                             host088
54545                             host238

I need an average for host123, host088, host238

The above query is also grouping the same times and displaying the counts, which is not preferred. 

 

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

Hi @BornConfused ,

If I understood your requirement correct, it should be as simple as:

|  stats avg(processTime) by host

 
When I add the sample table you provided as input, the given command puts out the average processing time per host:

host	avg(processTime)
host088	71877
host123	23092
host238	76766


Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @BornConfused ,

If I understood your requirement correct, it should be as simple as:

|  stats avg(processTime) by host

 
When I add the sample table you provided as input, the given command puts out the average processing time per host:

host	avg(processTime)
host088	71877
host123	23092
host238	76766


Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

BornConfused
Engager

Thank you ! This worked like a charm, I didn't think it was this easy.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this: 

base search query| stats count(processTime) by host 
| stats avg(count) as AvgProcessTime by host

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

BornConfused
Engager

Thank you, for your answer. But, this would return the number of times the base search was found by host:

| stats count(processTime) by host 

but thats not what is expected. I have updated the question to reflect the initial log. 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...