Splunk Search

How to get average for some fields but not all?

huan_an
Explorer

Hi,

I would like to get the average of multiple fields in the same row but not all, would anyone be able to advise on this?

query
| chart latest(time_taken) by process server

# Results

Process Local-1 Local-2 Avg(Local) Remote-1 Remote-2
A 1 2 1.5 2 2
B 1 3 2 3 3


I would like to add an Avg(Local) field which gives me the average time taken by the processes running on Local-1 and Local-2.

Appreciate any suggestions, thanks!

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

huan_an
Explorer

Thanks! This made me realise that we can iterate through columns by referencing the column names! 

It somehow didn't work at first but after viewing a few more posts, I realised I just had to initialise count and total before the for each loop for the query to work.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...