Splunk Search

How to search the average of one field by values of another field, then chart them side by side?

jasoholt
Engager

I am very new to Splunk and trying to learn manipulation like I would in Excel. My current task is to get an average of a result, and then display it by a device type. Let's assume the CSV looks like this:

DEVICE, RATIO
iphone, 20
iphone, 10
iphone, 15
samsung, 30
samsung, 12
samsung, 83

I want to get the average of the Ratios, by Device Type. And then Chart them side by side.

iphone 15
samsung 42

0 Karma

renjith_nair
Legend

Try this

your search |stats avg(RATIO) by DEVICE

OR

    your search |eventstats avg(RATIO) by DEVICE

If you want to repeat the values in each row

---
What goes around comes around. If it helps, hit it with Karma 🙂

renjith_nair
Legend

@jasoholt, please accept as 'answer' if it resolves your issue so that the thread will be closed

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...