Splunk Search

How to calculate the average from the result of the range function?

carlpier
Explorer

Hello,
I am looking for a way to calculate the avg from the result of the range function.
Here is the simple base search which finds all values for exit_status:

index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) avg(ETms) stdev(ETms) median(ETms) mode(ETms) range(ETms) perc99(ETms) by Service | sort count | reverse

I have to calculate the avg from the result of “range(ETms)”

Any help would be greatly appreciated.

Thanks in advance

0 Karma

aweitzman
Motivator

Easiest way to do this is use eventstats to add it to your table:

...your search... | eventstats avg(range(ETms))

carlpier
Explorer

I want to see the average of a single service, your solution is exposed in the grand total ( 5120.341137) for each service

0 Karma

aweitzman
Motivator

You already have the "average of a single service" in your initial post: ....avg(ETms)... by Service

What do you believe you are missing?

0 Karma

aweitzman
Motivator

Please show a table of what your results are now, and another table of what you want them to be. Please include column headers.

0 Karma

carlpier
Explorer

thanks for the replay, the function EventStats shows the total of each line, but I have to expose it to a single service

index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) range(ETms) by Service | eventstats avg(range(ETms)) | sort count | reverse

Service1 122286 1 1113 1112 5120.341137
Service2 63534 4 11109 11105 5120.341137

0 Karma

aweitzman
Motivator

eventstats is computing the average of every entry in range(ETms), and adding that result in a new column to each entry. If that isn't what you want, can you please show what you want your result to look like?

Also, when you do, please use the "code sample" button in the editor so that it looks like this, it will make it much easier to read:

Service1 122286 1  1113  1112 5120.341137
Service2  63534 4 11109 11105 5120.341137
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...