Splunk Search

How to add average to data that are not on the same line

lakromani
Builder

I have data in the form like this:

21:00 Pos=A Strength=45
21:00 Pos=B Strength=60
21:00 Pos=C Strength=32
22:00 Pos=A Strength=44
22:00 Pos=B Strength=62
22:00 Pos=C Strength=33

I do graph them like this:

my search | timechart avg(Strength) by Pos

Now I would like to have one average line for the three Position.
But do not see how to do this when data is not at the same line.
I tried to use transaction _time , but did not give me what I like.

0 Karma
1 Solution

woodcock
Esteemed Legend

Add this to the end of your search:

| eval numCols=0 
| foreach *  [ eval numCols = numCols + 1] 
| addtotals row=t col=f
| eval Total = Total / numCols
| fields - numCols

View solution in original post

0 Karma

woodcock
Esteemed Legend

Add this to the end of your search:

| eval numCols=0 
| foreach *  [ eval numCols = numCols + 1] 
| addtotals row=t col=f
| eval Total = Total / numCols
| fields - numCols
0 Karma

lakromani
Builder

I will accept this, since it was close, but did have errors.
Doing math after the timechart command did not cross my mind, but it is the right/best way to do it.
But you need to move the addtotals up to right after the timehart. If not, it will also sum the number of rows inn to the data. So my solution becomes like this:

my search 
| timechart avg(Strength) by Pos
| addtotals row=t col=f                     ! Give a new colum that contains the sum of all rows in a variable named Total
| eval numCols=-2                           ! -2 to ignore Total and numCol Column
| foreach *  [ eval numCols = numCols+1]    ! Count all coloums and store it in numCols
| eval Total = Total / numCols      ! Devide Total on numCols
| fields - numCols                          ! Remove the colum counter so it will not be grapehed
0 Karma

woodcock
Esteemed Legend

Initialize numCols to -2 to eliminate 1 step.

lakromani
Builder

Updated my post to reflect that. Thanks.

0 Karma

jkat54
SplunkTrust
SplunkTrust
...| timechart avg(Strength) 

Or if you want all of this on one graph

...| eval PosA=if(Pos=="A",Strength,0) | eval PosB=if(Pos=="B",Strength,0) | eval PosC=if(Pos=="C",Strength,0) | timechart avg(PosA) avg(PosB) avg(PosC) avg(Strength)
0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...