Splunk Search

How to edit my current search to find the average?

vtsguerrero
Contributor

Hello guys! Sup?
Can anyone help me to get the average of all current search events and not only the first ones. I have this search below which has everything I need, but just missin' the correct average. How can I achieve the correct average and variation:

index=main sourcetype=main_pc BOTH=* TABLE_VALUE=* PROCESS_NAME=* 
| eval PROCESS=PROCESS_NAME
| eval VOLUME=(BOTH+TABLE_VALUE)  
| streamstats avg(VOLUME) as AVERAGE
| eval VARIATION=((1-(VOLUME/AVERAGE))*100) 
| fieldformat VARIATION=round(VARIATION, 2) 
| table PROCESS_NAMEVOLUMEAVERAGE VARIATION
| rangemap field=VARIATION low=0-20 elevated=20.01-50 severe=40.01-100 default=low

And we get results with different values for each table row, should be the same for this amount of data returned by this current search and time period.

Tags (3)
0 Karma

maciep
Champion

Maybe you want to use eventstats instead of streamstats?

http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...