Splunk Search

Calculation using the number of events returned to determine average

dwong2
New Member

I have data similiar to this:

Account Count TotalSessions
abc 4 12
xyz 2 12
zzz 6 12

..search | stats count by Account | eventstats sum(count) as TotalSessions

How do I get the calculation for TotalSessions/ # of Accounts? i.e. 12 divided by 3 in this example.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Like this

..search | stats count by Account | eventstats sum(count) as TotalSessions dc(Account) as TotalAccounts
| eval AvgSessionPerAccount=TotalSessions/TotalAccounts

View solution in original post

dwong2
New Member

Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?

0 Karma

somesoni2
Revered Legend

Like this

..search | stats count by Account | eventstats sum(count) as TotalSessions dc(Account) as TotalAccounts
| eval AvgSessionPerAccount=TotalSessions/TotalAccounts

dwong2
New Member

Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...