Splunk Search

How do I add an extra row to calculate the average of the rows above?

Path Finder

I have connected to my database using Splunk DBConnect and using a simple sql query I have managed to get some data from the table. However I would like to have just one entry displayed that contains the average of the data above. How do I go about that? I am new to splunk.

Tags (2)


This works for me.

..| timechart span=1d count|appendpipe [stats avg(count) as Average]

Thanks to @echalex

0 Karma


The correct command for this would be appendpipe.

Say you have something like: ...|stats sum(score) AS totalscore by item. Then you can do this: ...|appendpipe [stats avg(totalscore) AS totalscore |eval item="AVERAGE"]. (You need to use AS in appendpipe in order to put the average in the same column. You can leave item empt, if you want.)



You can try using search command addcoltotals.


0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.