Splunk Search

How to get average for some fields but not all?

huan_an
Explorer

Hi,

I would like to get the average of multiple fields in the same row but not all, would anyone be able to advise on this?

query
| chart latest(time_taken) by process server

# Results

Process Local-1 Local-2 Avg(Local) Remote-1 Remote-2
A 1 2 1.5 2 2
B 1 3 2 3 3


I would like to add an Avg(Local) field which gives me the average time taken by the processes running on Local-1 and Local-2.

Appreciate any suggestions, thanks!

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

huan_an
Explorer

Thanks! This made me realise that we can iterate through columns by referencing the column names! 

It somehow didn't work at first but after viewing a few more posts, I realised I just had to initialise count and total before the for each loop for the query to work.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...