- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
arkmenster
Engager
09-25-2024
01:41 PM
I have this query
index=x host=y "searchTerm" | stats Avg(Field1) Avg(Field2)
which returns a count of N statistics.
I would like modify my query such that
(first stats value) statistics[0], (middle stats value) ((statistics[0]+statistics[N])/length(statistics)), (final stats value) statistics(N)
are returned in the same query
I have tried using head and tail but that still limits it to the specified value after 'head' or 'tail'. What other options are available?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
09-25-2024
02:37 PM
| streamstats count as row
| eventstats max(row) as total
| where row = 1 OR row = total OR row = floor(total / 2)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
09-25-2024
01:48 PM
Please explain, with some examples, what is in "statistics", what you mean by "first", "last" and "middle" and how this relates to the two averages that your stats command is returning.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
arkmenster
Engager
09-25-2024
02:01 PM
Thanks @ITWhisperer . So in the screenshot below, we see that 170 statistics were returned. I would like the query to return the 1st, the 85th/86th, and the 170th statistic, instead of all 170 of them. Is there a way to accomplish this?
sample
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
09-25-2024
02:37 PM
| streamstats count as row
| eventstats max(row) as total
| where row = 1 OR row = total OR row = floor(total / 2)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
arkmenster
Engager
09-25-2024
02:41 PM
Perfect. Thank you @ITWhisperer, your solution worked.
