Splunk Search

## How do you find the average delta of sum of fields in multiple events?

New Member

I need to be able to find the average of the daily delta of the sum of all BCP* fields and I am trying to do something like this:

``````...search...
| transaction _time
| delta bcp as delta_bcp
| stats avg(delta_bcp)
``````

But it doesn't work. How can I accomplish this?

Tags (5)
1 Solution
SplunkTrust

Hi @tommasocurto,

Try

``````your search |addtotals BCP* fieldname=bcp|timechart span=1d sum(bcp) as bcp|delta bcp as delta_bcp|fillnull value=0 delta_bcp|stats avg(delta_bcp)
``````

you shall replace fillnull with your choice to adjust the average for the first value

Explorer

To sum all of the BCP values you would need to use a case eval to make sure you capture all BCP values in a single event. Her is how I would do that:

| eval sumbcp=case(isnull(BCP3),BCP0+BCP1+BCP2,1=1,BCP0+BCP1+BCP2+BCP3)

The value in sumbcp would be the sum of all the BCP in the event. If BCP3 does not exist (it is null) it wont try adding it to the total, otherwise it will add BCP3.

The 1=1 is used as an else statement.

SplunkTrust

Hi @tommasocurto,

Try

``````your search |addtotals BCP* fieldname=bcp|timechart span=1d sum(bcp) as bcp|delta bcp as delta_bcp|fillnull value=0 delta_bcp|stats avg(delta_bcp)
``````

you shall replace fillnull with your choice to adjust the average for the first value

New Member

Thank you, this works just fine without "|fillnull value=0 delta_bcp".

Take the 2021 Splunk Career Survey

### Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey.Earn \$50 in Amazon cash! Full Details! >

Get Updates on the Splunk Community!