Splunk Search

Function AVG() give the wrong result ?

luthfi49
Explorer

Hi all,

When I use query : mysearch | stats avg(X)

It is supposed that the result is the average value of field X in the time range choosed.

But it is not give the proper result, I check it with top command and the value of the avg() is higher than the value in top command.

If the time range is longer, the result is more unproper

Is My Search's Query wrong ?

Here is my example search (time range 5 minutes) :

my search | stats avg(fieldX)

the result : 1273.0959

validation search (time range 5 minutes) search just before my above search

my search | top fieldX

the result's maximum value : 1137

Tags (2)
0 Karma
1 Solution

Ayn
Legend

top fieldX just tells you the number of events that have a certain value for fieldX. It doesn't use the value of the field in any other way.

So in your case, say you have the following values for fieldX:

1137
1250
1500
1137
1335
1137

top will then give you 1137 first of all, because that's the most commonly occurring value in your set. However the average of all the values in the set will be higher, because (1137+1250+1500+1137+1335+1137)/6 = 1249.3333.

View solution in original post

zeroactive
Path Finder

Insted of using "top fieldX", for the reasons stated by Ayn, use the following to see the maximum value in fieldX:

mysearch | stats max(fieldX)

0 Karma

Ayn
Legend

top fieldX just tells you the number of events that have a certain value for fieldX. It doesn't use the value of the field in any other way.

So in your case, say you have the following values for fieldX:

1137
1250
1500
1137
1335
1137

top will then give you 1137 first of all, because that's the most commonly occurring value in your set. However the average of all the values in the set will be higher, because (1137+1250+1500+1137+1335+1137)/6 = 1249.3333.

View solution in original post

luthfi49
Explorer

I'm sorry I didn't check the top command first.
Too early to ask the forum for my simple question 😄

Thanks 🙂

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!