Splunk Search

Difference average and mean

SilviaGebel
Path Finder

Hi,

as I can see in the Splunk docs, using | stats avg() and mean() shoud both give me the same results (arithmetic mean).

In my query I search for both of avg and mean. But I am only getting results for mean, not for average.
My search query is like this |index=x searchtype=x| stats avg() mean()

Why are there no results for average? Does average only work if Splunk automatically aggregates values for example to create the average of 5 min chunks? And mean takes all values and divides it by the total count?

Thank you!

Silvia

Tags (3)
0 Karma
1 Solution

acharlieh
Influencer

There is indeed no difference between the two, however I've noticed that Splunk only spits out results for one of them when they are averaging the same field. (Which makes sense, since why do twice the work for the same result). For example this search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2 = value | stats avg(val2) mean(value)

Spits our values for both but this search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | stats avg(value) mean(value)

Spits out a value for only one of them

View solution in original post

woodcock
Esteemed Legend

Is that your actual search? If so, the problem is that you need to tell Splunk what field to average by putting something inside the parentheses like this:

index=x sourcetype=x| stats avg(x) mean(x)

I have NEVER seen avg not work and I use it almost every day! If you are putting a field inside avg() then the answer is that the field you are telling Splunk to avg does not have any values for the search you are using.

0 Karma

acharlieh
Influencer

This isn't the problem. | stats avg is the same as | stats avg(*) which is spit out averages of all numeric fields. Example search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2=value | stats avg

acharlieh
Influencer

There is indeed no difference between the two, however I've noticed that Splunk only spits out results for one of them when they are averaging the same field. (Which makes sense, since why do twice the work for the same result). For example this search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2 = value | stats avg(val2) mean(value)

Spits our values for both but this search:

|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | stats avg(value) mean(value)

Spits out a value for only one of them

SilviaGebel
Path Finder

Oh - thank you. That makes sense.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...