I have quiz values for 10 quizzes. Each quiz is a column and the values are 0-100 in each row.
I am trying to just calculate the the average of each column and have that as a point on the line chart with 0-100 as the y-axis and each quiz as an x-axis column. For example.
| chart avg(quiz_01) AS "Quiz 1 Average", avg(quiz_02) AS "Quiz 2 Average", avg(quiz_03) AS "Quiz 3 Average"
But all of the points end up in the same column in the line chart.
Thanks
Is this the sort of thing you wanted
| gentimes start=-1 increment=1h
| eval quiz_01=random() % 101
| eval quiz_02=random() % 101
| eval quiz_03=random() % 101
| eval quiz_04=random() % 101
| eval quiz_05=random() % 101
| eval quiz_06=random() % 101
| eval quiz_07=random() % 101
| eval quiz_08=random() % 101
| eval quiz_09=random() % 101
| eval quiz_10=random() % 101
| fields - endhuman endtime starthuman starttime
| streamstats count as question
| untable question quiz score
| chart avg(score) as average_score by quiz
Lines before the blank lines just set up some example data - execute the search without the last two lines to see if the data is representative for your usecase - if it isn't please explain your scenario further
Is this the sort of thing you wanted
| gentimes start=-1 increment=1h
| eval quiz_01=random() % 101
| eval quiz_02=random() % 101
| eval quiz_03=random() % 101
| eval quiz_04=random() % 101
| eval quiz_05=random() % 101
| eval quiz_06=random() % 101
| eval quiz_07=random() % 101
| eval quiz_08=random() % 101
| eval quiz_09=random() % 101
| eval quiz_10=random() % 101
| fields - endhuman endtime starthuman starttime
| streamstats count as question
| untable question quiz score
| chart avg(score) as average_score by quiz
Lines before the blank lines just set up some example data - execute the search without the last two lines to see if the data is representative for your usecase - if it isn't please explain your scenario further
Thanks, this worked as expected.
Hi
you probably need to use stats instead of chart? Here is explanation about those https://community.splunk.com/t5/Splunk-Search/Difference-between-stats-and-chart/m-p/89858.
r. Ismo