Splunk Search

Display line chart of average of fields

bfreese
Engager

I have quiz values for 10 quizzes. Each quiz is a column and the values are 0-100 in each row.

I am trying to just calculate the the average of each column and have that as a point on the line chart with 0-100 as the y-axis and each quiz as an x-axis column.  For example.

| chart avg(quiz_01) AS "Quiz 1 Average", avg(quiz_02) AS "Quiz 2 Average", avg(quiz_03) AS "Quiz 3 Average"

But all of the points end up in the same column in the line chart.

Thanks

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Is this the sort of thing you wanted

| gentimes start=-1 increment=1h 
| eval quiz_01=random() % 101 
| eval quiz_02=random() % 101 
| eval quiz_03=random() % 101
| eval quiz_04=random() % 101 
| eval quiz_05=random() % 101 
| eval quiz_06=random() % 101
| eval quiz_07=random() % 101 
| eval quiz_08=random() % 101 
| eval quiz_09=random() % 101
| eval quiz_10=random() % 101
| fields - endhuman endtime starthuman starttime
| streamstats count as question



| untable question quiz score
| chart avg(score) as average_score by quiz

Lines before the blank lines just set up some example data - execute the search without the last two lines to see if the data is representative for your usecase - if it isn't please explain your scenario further

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Is this the sort of thing you wanted

| gentimes start=-1 increment=1h 
| eval quiz_01=random() % 101 
| eval quiz_02=random() % 101 
| eval quiz_03=random() % 101
| eval quiz_04=random() % 101 
| eval quiz_05=random() % 101 
| eval quiz_06=random() % 101
| eval quiz_07=random() % 101 
| eval quiz_08=random() % 101 
| eval quiz_09=random() % 101
| eval quiz_10=random() % 101
| fields - endhuman endtime starthuman starttime
| streamstats count as question



| untable question quiz score
| chart avg(score) as average_score by quiz

Lines before the blank lines just set up some example data - execute the search without the last two lines to see if the data is representative for your usecase - if it isn't please explain your scenario further

bfreese
Engager

Thanks, this worked as expected.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you probably need to use stats instead of chart? Here is explanation about those https://community.splunk.com/t5/Splunk-Search/Difference-between-stats-and-chart/m-p/89858.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...