Splunk Search

How to find the remove the decimal places of an 2 averages and display each field as a bar on a bar chart

Weng
New Member

For the following data,

Date=4 June 2013, Result=Win,Ticks=11,Setup=Range Fade, Risk=10, Target=11
.....and more

I would like to find the average for the Risk and Target fields each and to remove the decimal places. I have written the following query:
source="Trading Stats.txt" | search Risk | search Target | stats avg(Risk) as average_risk avg(Target) as average_target
which can display the average of each of the Risk and Target fields but I am unable to get the round function to work.

In addition, I would also like to show the data on a bar chart with the average value of the Risk field as 1 bar and the average value of the Target field as the second bar on the same chart.

How do I do so?

Thanks

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this for rounding and charting:

source="Trading Stats.txt" Risk=* Target=* | chart avg(Risk) as average_risk avg(Target) as average_target by source | eval average_risk = round(average_risk) | eval average_target = round(average_target)

That should give you one row of results with three columns, which can be displayed in a chart - just click the chart button and select bar chart or whatever you need. Note the by source bit, serving as one of the axes of the chart.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The second argument is optional, implied zero.

0 Karma

linu1988
Champion

round takes 2 arguments eval average_risk = round(average_risk,2) | eval average_target = round(average_target,2)

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...