Splunk Search
Highlighted

How to search and calculate the average for the top 70 percent of a field?

Engager

How to calculate the average for top 70%. A field in log contains a value. I need to ignore the least 30% and then calculate average.

Tags (3)
Highlighted

Re: How to search and calculate the average for the top 70 percent of a field?

Influencer

Try this

some search terms.. | sort 0 - Field_Of_Interest | streamstats count as Rank | eventstats count as TotalRows | where Rank<(TotalRows * 0.7) | stats avg(Field_Of_Interest) as Required_Average

View solution in original post