Splunk Search

Stats count and average

rhinomike
Explorer

I have a log that more or less looks like:

 timestamp=1422006650  from=bob@sender.com to=alice@receiver.com subject="I love you honey" score=100 
 timestamp=1422007650    from=bob@sender.com to=alice@receiver.com subject="I love you honey" score=100 
 timestamp=1422008650    from=eve@sender.com to=alice@receiver.com subject="I loved him first" score=100
 timestamp=1422009650    from=eve@sender.com to=alice@receiver.com subject="I loved you first" score=50
 timestamp=1422009750    from=eve@sender.com to=alice@receiver.com subject="I loved him  first" score=10

I am now trying to perform a stats like

from                    subject                 count_to    avg_score
bob@sender.com          I love you honey       2       100
eve@sender.com          I loved you first      1       50
eve@sender.com          I loved him first      2       55

If I'm not mistaken, I can use:

stats count by from,to, subject to build the four first columns, however it is not clear to me how to calculate the average for a particular set of values in accordance with the first round of stats.

Is it possible?

Tags (1)
0 Karma
1 Solution

aweitzman
Motivator

This should work:

... | stats count as count_to avg(score) as avg_score by from subject

View solution in original post

0 Karma

aweitzman
Motivator

This should work:

... | stats count as count_to avg(score) as avg_score by from subject

0 Karma

rhinomike
Explorer

Solved it perfectly. Thanks

0 Karma
Get Updates on the Splunk Community!

Incident Response: Reduce Incident Recurrence with Automated Ticket Creation

Culture extends beyond work experience and coffee roast preferences on software engineering teams. Team ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...