Splunk Search

How do you find the average delta of sum of fields in multiple events?

tommasocurto
New Member

alt text

I need to be able to find the average of the daily delta of the sum of all BCP* fields and I am trying to do something like this:

...search...    
    | transaction _time
    | addtotals BCP* fieldname=bcp
    | delta bcp as delta_bcp
    | stats avg(delta_bcp)

But it doesn't work. How can I accomplish this?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @tommasocurto,

Try

your search |addtotals BCP* fieldname=bcp|timechart span=1d sum(bcp) as bcp|delta bcp as delta_bcp|fillnull value=0 delta_bcp|stats avg(delta_bcp)

you shall replace fillnull with your choice to adjust the average for the first value

Happy Splunking!

View solution in original post

pjdwyer
Explorer

To sum all of the BCP values you would need to use a case eval to make sure you capture all BCP values in a single event. Her is how I would do that:

| eval sumbcp=case(isnull(BCP3),BCP0+BCP1+BCP2,1=1,BCP0+BCP1+BCP2+BCP3)

The value in sumbcp would be the sum of all the BCP in the event. If BCP3 does not exist (it is null) it wont try adding it to the total, otherwise it will add BCP3.

The 1=1 is used as an else statement.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @tommasocurto,

Try

your search |addtotals BCP* fieldname=bcp|timechart span=1d sum(bcp) as bcp|delta bcp as delta_bcp|fillnull value=0 delta_bcp|stats avg(delta_bcp)

you shall replace fillnull with your choice to adjust the average for the first value

Happy Splunking!

tommasocurto
New Member

Thank you, this works just fine without "|fillnull value=0 delta_bcp".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...