Splunk Search

How to print latest value and average value of a column

SG
Path Finder

Hi, I have a list of values as shown below 

SG_0-1622095994335.png

from the above picture data I wanted to pick the average of each column's values and the latest value of that column also. I am able to successfully take the average value but unable to print the latest value. Please help.

 

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| chart avg(objectSize) as average, tail 1 as latest by url

 

I gave "tail 1" to get the average value but the query is giving an error while executing it.

SG_1-1622096202486.png

 

Thanks,

 

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try the next:

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| chart avg(objectSize) as average latest(objectSize) as latest by url

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try the next:

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| chart avg(objectSize) as average latest(objectSize) as latest by url

r. Ismo 

gcusello
SplunkTrust
SplunkTrust

Hi @SG,

I don't know if this is what you'r waiting for:

if you want a row for each url with average an latest value you can try this:

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| stats avg(objectSize) as average last(url) AS latest latest by url

If you want two values for each column in your chart, the easiest way is to have two tables.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...