Splunk Search

Perform an operation on values in the column of a lookup table that share the same row values

matthewob5
Engager

I have a lookup table that looks like this (:

Column 1Column 2Column 3Column 4
Value 1--15
Value 1--60
Value 2--75
Value 2--N/A
Value 2--5

 

I want to calculate the average for all of the values in Column 4 (that aren't N/A) that have the same value in Column 1. Then I want to output that as a table:

Column 1Column 2
Value 137.5
Value 240
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command can do that, although I'm not sure how it will handle "N/A".

| stats avg('Column 4') as "Column 2" by 'Column 1'

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...