Splunk Search
Highlighted

Display Avg Column

New Member

sourcetype="emailprocess" | eval processingtimeinseconds = processingtime/1000 | table email, processingtime ,processingtimeseconds | chart sum(processingtimeseconds), count(processing_time) by email

The output of this is

email sum(processingtimeseconds) count(processing_time)
a@xx.com 1000 2
b@xx.com 2000 10

I would like to add another column called averagetime that lists averagetime for each email. Note averagetime=sum(processingtimeseconds) / count(processingtime)

Desired output
email sum(processingtimeseconds) count(processingtime) AvgTime_millisecond
a@xx.com 1000 2 500
b@xx.com 2000 10 200

Tags (4)
0 Karma
Highlighted

Re: Display Avg Column

Legend

As per your example, all you need to do is add | eval Avg=Total/Count to your existing query. PS: I have renamed fields for easy use in Splunk query and also for readability. If you need column names same as what you have specified you can
1) Either use single quotes to escape special characters in the field name (for the field names in your query)
2) or else use rename command to rename fields to what you need.

 sourcetype="email_process" 
| eval processing_time_in_seconds = processing_time/1000 
| table email, processing_time ,processing_time_seconds 
| chart sum(processing_time_seconds) as Total, count(processing_time) as Count by email
| eval Avg=Total/Count



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Display Avg Column

Legend

@signpriya82... Did this answer or something else worked out for you?




| eval message="Happy Splunking!!!"


0 Karma