Splunk Search

## Getting a wrong answer for the calculation of mean in splunk

Motivator

Hello

I am trying to calculate the mean of a field and it's strange that splunk cal the mean in a completely different manner.

week A B mean(B)
1 41 1290 0 0.000000
2 42 1372 82 82.000000
3 43 81 1291 1291.000000

As you can see above the value is kind of wrong. The command which I used was

``````sourcetype=incident record.affectedCI="xxxx"| eval week=tonumber(strftime(_time,"%U"))  | stats count by week | rename count as A |delta A as B | eval B=coalesce(B,0) | eval B = abs(B) | stats mean(B) by week A B
``````

In my understanding of math it should have been (0+82+1291)/3 and it should have been the same value for all the weeks. Can anyone please let me know if I am missing something here.

Regards

theou

Tags (1)
1 Solution
Splunk Employee

stats evaluates per-event, grouping by your differentiators (the by-clause). Try eventstats. In this case, an example invocation would be like this (replace the stats command at the end of your search):

``` | eventstats mean(B) ```

Splunk Employee

stats evaluates per-event, grouping by your differentiators (the by-clause). Try eventstats. In this case, an example invocation would be like this (replace the stats command at the end of your search):

``` | eventstats mean(B) ```

Motivator

Ahaa.. Got it. I understand it now on why it messed it up. Thanks for the clarification.

Get Updates on the Splunk Community!

#### Unlock the Power of Your Splunk Data

REGISTER NOW!Tech Talk: Security EditionWednesday, August 28, 2024  |  11AM PT / 2PM ETIt’s time to accelerate ...

#### App Building 101 - Build Your First App!

REGISTER NOW!   Tech Talk: App Dev EditionTuesday, August 27, 2024  |  9AM PT / 12PM ETSplunk has tons of ...

#### Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...