Splunk Search

How to get average for some fields but not all?

huan_an
Explorer

Hi,

I would like to get the average of multiple fields in the same row but not all, would anyone be able to advise on this?

query
| chart latest(time_taken) by process server

# Results

Process Local-1 Local-2 Avg(Local) Remote-1 Remote-2
A 1 2 1.5 2 2
B 1 3 2 3 3


I would like to add an Avg(Local) field which gives me the average time taken by the processes running on Local-1 and Local-2.

Appreciate any suggestions, thanks!

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

huan_an
Explorer

Thanks! This made me realise that we can iterate through columns by referencing the column names! 

It somehow didn't work at first but after viewing a few more posts, I realised I just had to initialise count and total before the for each loop for the query to work.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...