Splunk Search

Using Eval and stats together

ianpaquette
New Member

I am trying to feed the results of (2) subsearches into and eval search.

| eval Average=data/asstes [stats sum(data) | return $data] [stats count(MAC_Address) | retun $assets]

there may bay a better way to do this... I need to sum of data divded by to total number of unique MAC addresses.

Any help is appreciated.

0 Karma

masonmorales
Influencer

Can you post some sample data?

0 Karma

anmolpatel
Builder

try this instead:

| eventstats sum(data) as sum_of_data dc(MAC_Address) as dc_of_MAC_Address
| eval average = sum_of_data / dc_of_MAC_Address
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...