Splunk Search

How to get average for some fields but not all?

huan_an
Explorer

Hi,

I would like to get the average of multiple fields in the same row but not all, would anyone be able to advise on this?

query
| chart latest(time_taken) by process server

# Results

Process Local-1 Local-2 Avg(Local) Remote-1 Remote-2
A 1 2 1.5 2 2
B 1 3 2 3 3


I would like to add an Avg(Local) field which gives me the average time taken by the processes running on Local-1 and Local-2.

Appreciate any suggestions, thanks!

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| foreach Local-*
    [| eval count=count+1
    | eval total=total+'<<FIELD>>']
| eval "Avg(Local)"=total/count

huan_an
Explorer

Thanks! This made me realise that we can iterate through columns by referencing the column names! 

It somehow didn't work at first but after viewing a few more posts, I realised I just had to initialise count and total before the for each loop for the query to work.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...