Splunk Search

How to print latest value and average value of a column

SG
Path Finder

Hi, I have a list of values as shown below 

SG_0-1622095994335.png

from the above picture data I wanted to pick the average of each column's values and the latest value of that column also. I am able to successfully take the average value but unable to print the latest value. Please help.

 

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| chart avg(objectSize) as average, tail 1 as latest by url

 

I gave "tail 1" to get the average value but the query is giving an error while executing it.

SG_1-1622096202486.png

 

Thanks,

 

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try the next:

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| chart avg(objectSize) as average latest(objectSize) as latest by url

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try the next:

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| chart avg(objectSize) as average latest(objectSize) as latest by url

r. Ismo 

gcusello
SplunkTrust
SplunkTrust

Hi @SG,

I don't know if this is what you'r waiting for:

if you want a row for each url with average an latest value you can try this:

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle"
| stats avg(objectSize) as average last(url) AS latest latest by url

If you want two values for each column in your chart, the easiest way is to have two tables.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...