How do you compute the average number of emails contained in two different sources?

[maryamchar]

I have two different sourcetypes with same index name. Both sources they have emails and it shows the number of those emails. I would like to aggregate both sources and find the average of emails from both sources, represent that on graph.

source="source1" source="source2" index=testing |stats avg(Emails) by companyName

I'm using Splunk Enterprise(Search and Reporting) -> making dashboards. Thank you in advance.

[kmaron · Accepted solution]

You switch from saying sourcetype to saying source. These are two different things. Since the partial SPL you provided says source I'm going to run with that. You can always replace source with sourcetype and it will still work.

This would get you the average number of emails per company name and source

index=testing (source="source1" OR source="source2") 
| stats avg(Emails) as Average by companyName source

You can then choose your visualization to determine the type of graph you want.

[maryamchar]

sorry i meant source. The above gave me the result of an average of one source and not combined. I want the average of both sources combined for emails by company.

[kmaron]

You just need to remove source.

  index=testing (source="source1" OR source="source2") 
  | stats avg(Emails) as Average by companyName

[maryamchar]

Thank you!