Splunk Search

## Calculate avg , min , max for per multivalue field

Communicator

Hi !

I would like to ask question whether following calculation is possible or not?
For following case,

customer type amount
A a 10
A a 20
A b 10
B a 5
B a 10

I want to calculate fields as

customer type count min max avg
A a 2 10 20 15
b 1 10 10 10
B a 2 5 10 7.5

However, I have tried that

stats values(type) , count, min(amount), max(amount), avg(amount) by customer

does not work...

I would appreciate if someone can help me out with this issue.

Thanks,
Yu

Tags (2)
Builder

Hi Yutennis,

Putting your data into a lookup tennis.csv:

``````customer,type,amount
A, a, 10
A, a, 20
A, b, 10
B, a, 5
B, a, 10
``````

I used the search:

``````| inputlookup tennis.csv | stats count, max(amount), min(amount), avg(amount) by customer, type
``````

Which gave me this:

Hope this of some help! 🙂

Builder

No problems Yu - Please accept Hiroshi's answer so other people can find the solution.

いいえ問題は - 他の人が解決策を見つけることができるように Hiroshi's の答えを受け入れてくださいませ

Communicator

Hello R.Turk.

I was not aware that you can specify multiple fields in stats!

The result came out the way I wanted .

Thanks
Yu

Builder

Champion

The result is useless or in the following?Please let me know if there is something objective.

stats count, min(amount), max(amount), avg(amount) by customer,type
customer type count min max avg
A a 2 10 20 15
A b 1 10 10 10
B a 2 5 10 7.5

Champion

これはもう解決したと思ってよいか？
Is it may be considered to have resolved this anymore?

サンプルに近いフォーマットならこんな感じになると思う。
I think to be a feeling that if format close to the sample.

･･･ | stats count as count, min(amount) as min, max(amount) as max, avg(amount) as avg by customer,type|stats list(type) as type,list(count) as count,list(min) as min,list(max) as max,list(avg) as avg by customer

Communicator

Hello Hiroshi.

ex1：
customer type amount
A a 10
A a 10
A a 10
A b 10
B b 20
B c 10
C a 10

res1：
customer type avg min max
A a 10 10 10
b 10 10 10
B b 20 20 20
c 10 10 10
C a 10 10 10

Champion

Hi. yuwtennis.I also love tennis.

もう少しバリエーションをふやして結果のイメージを提供してもらえませんか？

Could you provide an image of the result by increasing the variation a little more?

Communicator

customer 別 に type の値を計算したいのですが、
どうもうまくいかないみたいで。。。もし、

Communicator

Hello Hiroshi.

My goal is to calculate the stats (max, min , avg) by type per customer.
I believe just simply specifying "by" statement in stats groups by
type regardless of customer.

So if something like ,

stats ( count by type ) by customer

can happen, I can achieve my goal.

Get Updates on the Splunk Community!

#### Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...