Splunk Search

## How to calculate the average of a column, and display this average next to it in a separate column?

Builder

I displayed the list of people and their count by using the below search:

``````foo | stats dc(A) as people by B
``````

which displayed as follows

``````people      B
asd         23
sdas        32
``````

Now how can I calculate the average of all the values in B and display the average in another column?

Tags (5)
1 Solution
Super Champion
``````foo | stats dc(A) as people by B|eventstats avg(people) as avgPeople|stats max(people) as people max(avgPeople) as avgPeople by B
``````

something like this might be what you're looking for

Super Champion
``````foo | stats dc(A) as people by B|eventstats avg(people) as avgPeople|stats max(people) as people max(avgPeople) as avgPeople by B
``````

something like this might be what you're looking for

Builder

now how can I display only the people with B values greater than avgPeople and also how to calculate their count?

Super Champion
``````foo | stats dc(A) as people by B|eventstats avg(people) as avgPeople|stats max(people) as people max(avgPeople) as avgPeople by B|where people>avgPeople
``````

calculate what count exactly? did you want to just add `count` to the first stats command and add `max(count) as totalCount` to the second command?

Builder

I would be really appriciate if you can suggest me a way to display a timechart which displays the avgpeople and people by B with time. @cmerriman

Super Champion
``````foo | stats dc(A) as people by B _time|eventstats avg(people) as avgPeople|timechart span=1d max(people) as people max(avgPeople) as avgPeople by B |where people>avgPeople
``````

you might play around with the first stats command. maybe add a `|bucket _time span=1d` before it or something, depending on what your `_time` field looks like.