Splunk Search

How do you calculate the average across columns in a table?

splunker1981
Path Finder

Hello Splunkers

I tried a few of the suggested solutions, but none of them got me where I need to be, so i'm asking the larger group.

I'm trying to get the average across columns. Some of my columns contain null values, so i want to make sure that doesn't throw off my count, which is why i'm not simply adding each and dividing by the column number. With the data below, what's the best approach to getting an average across columns, with some having nulls. Sample data and results shown below. Thanks in advance

location  col1    col2         col3     col4     average_here
Florida      7    null_here       0        2            3
New York     3       0            0        2            1.25
Texas       10      23        null_here    3            12
0 Karma
1 Solution

renjith_nair
Legend

@splunker1981 ,

Try this,

"Your base search to get fields"|addtotals|eval colcount=-1
|foreach col* [eval colcount=if(isnull(<<FIELD>>) OR <<FIELD>>=="",colcount,colcount+1)]
|eval avg=exact(Total/colcount)|fields - Total,colcount

Added conditions for both null and empty string in if(isnull(<<FIELD>>) OR <<FIELD>>=="" . If you have real null() in place, then you can remove OR <<FIELD>>==""

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@splunker1981 ,

Try this,

"Your base search to get fields"|addtotals|eval colcount=-1
|foreach col* [eval colcount=if(isnull(<<FIELD>>) OR <<FIELD>>=="",colcount,colcount+1)]
|eval avg=exact(Total/colcount)|fields - Total,colcount

Added conditions for both null and empty string in if(isnull(<<FIELD>>) OR <<FIELD>>=="" . If you have real null() in place, then you can remove OR <<FIELD>>==""

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...