Hello Splunkers
I tried a few of the suggested solutions, but none of them got me where I need to be, so i'm asking the larger group.
I'm trying to get the average across columns. Some of my columns contain null values, so i want to make sure that doesn't throw off my count, which is why i'm not simply adding each and dividing by the column number. With the data below, what's the best approach to getting an average across columns, with some having nulls. Sample data and results shown below. Thanks in advance
location col1 col2 col3 col4 average_here
Florida 7 null_here 0 2 3
New York 3 0 0 2 1.25
Texas 10 23 null_here 3 12
@splunker1981 ,
Try this,
"Your base search to get fields"|addtotals|eval colcount=-1
|foreach col* [eval colcount=if(isnull(<<FIELD>>) OR <<FIELD>>=="",colcount,colcount+1)]
|eval avg=exact(Total/colcount)|fields - Total,colcount
Added conditions for both null and empty string in if(isnull(<<FIELD>>) OR <<FIELD>>==""
. If you have real null() in place, then you can remove OR <<FIELD>>==""
@splunker1981 ,
Try this,
"Your base search to get fields"|addtotals|eval colcount=-1
|foreach col* [eval colcount=if(isnull(<<FIELD>>) OR <<FIELD>>=="",colcount,colcount+1)]
|eval avg=exact(Total/colcount)|fields - Total,colcount
Added conditions for both null and empty string in if(isnull(<<FIELD>>) OR <<FIELD>>==""
. If you have real null() in place, then you can remove OR <<FIELD>>==""