Probably the direct translation that you are looking for:
... | stats avg(a), first(a), first(b), first(c) by a,b,c
although if you are grouping by a, b, and c, it doesn't make a lot of sense to also be asking for a, b, and c, as the values will always be identical. (It's similarly pointless in the SQL version.) Note that with Splunk, you must specify first(b) as b for example, rather than just b, because you must say what to do if there happen to be multiple values of b in one of the groups. When you just ask for b in SQL, it's basically either taking the first, last, or some arbitrary value from the group. In the particular case where you are splitting by b (among other fields), there will only be one possible value, so it's unnecessary to ask for it. So you could actually get the exact same information with:
... | stats avg(a) by a,b,c
However, you might actually mean to query for:
... | stats avg(a), first(a) as a, first(b) as b, first(c) as c by x,y,z
which would be the equivalent of the SQL:
select avg(a),a,b,c from ... group by x,y,z
(Again, we have to tell Splunk how to resolve potential multiple values of a, b, or c. Using the function first() is basically what SQL does if you don't specify an aggegration function.)
Then, if you need it split by day:
... | bucket _time span=1d
| stats
avg(a)
first(a) as a
first(b) as b
first(c) as c
by _time,x,y,z
will do it.
