Splunk Search

Return top, middle, and bottom returns from query results using stats

arkmenster
Engager

I have this query

index=x host=y "searchTerm" | stats Avg(Field1) Avg(Field2)

which returns a count of N statistics.

I would like modify my query such that

(first stats value) statistics[0], (middle stats value) ((statistics[0]+statistics[N])/length(statistics)), (final stats value) statistics(N)

are returned in the same query

I have tried using head and tail but that still limits it to the specified value after 'head' or 'tail'. What other options are available?

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row
| eventstats max(row) as total
| where row = 1 OR row = total OR row = floor(total / 2)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain, with some examples, what is in "statistics", what you mean by "first", "last" and "middle" and how this relates to the two averages that your stats command is returning.

0 Karma

arkmenster
Engager

Thanks @ITWhisperer . So in the screenshot below, we see that 170 statistics were returned. I would like the query to return the 1st, the 85th/86th, and the 170th statistic, instead of all 170 of them. Is there a way to accomplish this?

samplesample

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row
| eventstats max(row) as total
| where row = 1 OR row = total OR row = floor(total / 2)
0 Karma

arkmenster
Engager

Perfect. Thank you @ITWhisperer, your solution worked.

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...