Subsearch calculating average of hits and showing list of values higher than the average?

[changwoo]

I am trying to make a subsearch which calculates the avg of the hits .
And showing the list of higher value than the avg.

i tried the search like this :
index= temp sourcetype = searchlog [search index = temp sourcetype = searchlog |stats avg(searchKeyword.hits) as avg | fields avg] | table avg

What's the problem ?

[Suda · Accepted solution]

Hello,

Could you try to use "eventstats"?

I think the "Example 3" of eventstats would be the same as your requirement.

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Eventstats

index=temp sourcetype=searchlog | eventstats avg(searchKeyword.hits) AS avg | where searchkeyword.hits > avg

I hope it helps you. Happy splunking!

[changwoo]

Thanks!!! it works perfect!!!

[martin_mueller]

Note, you need to enclose searchKeyword.hits in single quotes for the where (and the RHS of eval) commands:

... | where 'searchKeyword.hits' > avg

Else the command will interpret the dot as the string concatenation operator.