Splunk Search

How to get an avg field result in a stats values command

egrignon
Explorer

Hello Splunk Users

I m trying to get an average response time per IP for a few sites I m monitoring.

  • | stats values(remote_ip) avg(time) by url

This gives me the a list of URL with all ip values found for it. However, it is showing the avg time for all IP instead of the avg time for every IP.

The only solution I found was to use:

  • | stats avg(time) by url, remote_ip

However, that makes the report looks heavy and not very friendly since the same url are showing multiple times.

Is there any way to get the avg time by remote_ip, which is itself by url without having duplicates entries in the output?

Thank you in advance,

EG

Tags (2)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

I am not sure this is what you're looking for but if you just want a report with urls then a list of ips and a list of the times per IP try this:

| stats avg(time) as "time_per_ip" by url, remote_ip | stats list(remote_ip) as "IPs" list(time_per_ip) as "time_per_ip" by url | table url IPs times_per_ip

This will give you a consolidated table.

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

I am not sure this is what you're looking for but if you just want a report with urls then a list of ips and a list of the times per IP try this:

| stats avg(time) as "time_per_ip" by url, remote_ip | stats list(remote_ip) as "IPs" list(time_per_ip) as "time_per_ip" by url | table url IPs times_per_ip

This will give you a consolidated table.

egrignon
Explorer

Perfect, that did the trick.

Thank you.

EG

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...