Splunk Search

How do I add an extra row to calculate the average of the rows above?

BobKimata
Path Finder

I have connected to my database using Splunk DBConnect and using a simple sql query I have managed to get some data from the table. However I would like to have just one entry displayed that contains the average of the data above. How do I go about that? I am new to splunk.

Tags (2)

jawaharas
Motivator

This works for me.

..| timechart span=1d count|appendpipe [stats avg(count) as Average]

Thanks to @echalex

0 Karma

echalex
Builder

The correct command for this would be appendpipe.

Say you have something like: ...|stats sum(score) AS totalscore by item. Then you can do this: ...|appendpipe [stats avg(totalscore) AS totalscore |eval item="AVERAGE"]. (You need to use AS in appendpipe in order to put the average in the same column. You can leave item empt, if you want.)

vganjare
Builder

Hi,

You can try using search command addcoltotals.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...