Splunk Search

How do you compute the average number of emails contained in two different sources?

maryamchar
Explorer

I have two different sourcetypes with same index name. Both sources they have emails and it shows the number of those emails. I would like to aggregate both sources and find the average of emails from both sources, represent that on graph.

source="source1" source="source2" index=testing |stats avg(Emails) by companyName

I'm using Splunk Enterprise(Search and Reporting) -> making dashboards. Thank you in advance.

Tags (1)
0 Karma
1 Solution

kmaron
Motivator

You switch from saying sourcetype to saying source. These are two different things. Since the partial SPL you provided says source I'm going to run with that. You can always replace source with sourcetype and it will still work.

This would get you the average number of emails per company name and source

index=testing (source="source1" OR source="source2") 
| stats avg(Emails) as Average by companyName source

You can then choose your visualization to determine the type of graph you want.

View solution in original post

0 Karma

kmaron
Motivator

You switch from saying sourcetype to saying source. These are two different things. Since the partial SPL you provided says source I'm going to run with that. You can always replace source with sourcetype and it will still work.

This would get you the average number of emails per company name and source

index=testing (source="source1" OR source="source2") 
| stats avg(Emails) as Average by companyName source

You can then choose your visualization to determine the type of graph you want.

0 Karma

maryamchar
Explorer

sorry i meant source. The above gave me the result of an average of one source and not combined. I want the average of both sources combined for emails by company.

0 Karma

kmaron
Motivator

You just need to remove source.

  index=testing (source="source1" OR source="source2") 
  | stats avg(Emails) as Average by companyName
0 Karma

maryamchar
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...