Splunk Search

Function AVG() give the wrong result ?

luthfi49
Explorer

Hi all,

When I use query : mysearch | stats avg(X)

It is supposed that the result is the average value of field X in the time range choosed.

But it is not give the proper result, I check it with top command and the value of the avg() is higher than the value in top command.

If the time range is longer, the result is more unproper

Is My Search's Query wrong ?

Here is my example search (time range 5 minutes) :

my search | stats avg(fieldX)

the result : 1273.0959

validation search (time range 5 minutes) search just before my above search

my search | top fieldX

the result's maximum value : 1137

Tags (2)
0 Karma
1 Solution

Ayn
Legend

top fieldX just tells you the number of events that have a certain value for fieldX. It doesn't use the value of the field in any other way.

So in your case, say you have the following values for fieldX:

1137
1250
1500
1137
1335
1137

top will then give you 1137 first of all, because that's the most commonly occurring value in your set. However the average of all the values in the set will be higher, because (1137+1250+1500+1137+1335+1137)/6 = 1249.3333.

View solution in original post

zeroactive
Path Finder

Insted of using "top fieldX", for the reasons stated by Ayn, use the following to see the maximum value in fieldX:

mysearch | stats max(fieldX)

0 Karma

Ayn
Legend

top fieldX just tells you the number of events that have a certain value for fieldX. It doesn't use the value of the field in any other way.

So in your case, say you have the following values for fieldX:

1137
1250
1500
1137
1335
1137

top will then give you 1137 first of all, because that's the most commonly occurring value in your set. However the average of all the values in the set will be higher, because (1137+1250+1500+1137+1335+1137)/6 = 1249.3333.

luthfi49
Explorer

I'm sorry I didn't check the top command first.
Too early to ask the forum for my simple question 😄

Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...