Splunk Search

## How do you calculate the average across columns in a table?

Path Finder

Hello Splunkers

I tried a few of the suggested solutions, but none of them got me where I need to be, so i'm asking the larger group.

I'm trying to get the average across columns. Some of my columns contain null values, so i want to make sure that doesn't throw off my count, which is why i'm not simply adding each and dividing by the column number. With the data below, what's the best approach to getting an average across columns, with some having nulls. Sample data and results shown below. Thanks in advance

``````location  col1    col2         col3     col4     average_here
Florida      7    null_here       0        2            3
New York     3       0            0        2            1.25
Texas       10      23        null_here    3            12
``````
Tags (3)
1 Solution
Legend

@splunker1981 ,

Try this,

``````"Your base search to get fields"|addtotals|eval colcount=-1
|foreach col* [eval colcount=if(isnull(<<FIELD>>) OR <<FIELD>>=="",colcount,colcount+1)]
|eval avg=exact(Total/colcount)|fields - Total,colcount
``````

Added conditions for both null and empty string in `if(isnull(<<FIELD>>) OR <<FIELD>>==""` . If you have real null() in place, then you can remove `OR <<FIELD>>==""`

---
What goes around comes around. If it helps, hit it with Karma 🙂
Legend

@splunker1981 ,

Try this,

``````"Your base search to get fields"|addtotals|eval colcount=-1
|foreach col* [eval colcount=if(isnull(<<FIELD>>) OR <<FIELD>>=="",colcount,colcount+1)]
|eval avg=exact(Total/colcount)|fields - Total,colcount
``````

Added conditions for both null and empty string in `if(isnull(<<FIELD>>) OR <<FIELD>>==""` . If you have real null() in place, then you can remove `OR <<FIELD>>==""`

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

#### New This Month - More Capabilities to Simplify GDI Plus Enhancements in Observability ...

The latest enhancements to the Observability Portfolio deliver more assisted onboarding and expanded content ...

#### Ingest Actions Output Announces Support for File System Destinations

Introduction As part of Splunk Enterprise 9.3, we are proud to announce the general availability of File ...

#### Autoscaling Kubernetes Workloads with Splunk

About What if you had the ability to scale your Kubernetes pods as a result of information output from Splunk? ...