Splunk Search

appendpipe variable

daktapaal
Path Finder

Hi Guys,

appendpipe [stats avg(*) as *], adds a new row with the average of all the rows of the respective column.
I wanted to get hold of this average value . So I didappendpipe [stats avg(*) as average(*)] . So that I can use the "average" as a variable . This is all fine. The issue is when i do the appendpipe [stats avg(*) as average(*)] , I get new columns added, with the names average(colname) and the row that existed before , with appendpipe [stats avg(*) as *] gets deleted..

How do I keep the averages row as it is , still be able to use average(*) , so that I can get the average value in a variable? is it possible?

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm not quite sure I understand your question properly, so I'll take a stab in the dark. Are you trying to add horizontal average lines into a timechart?

If so, do something like this:

some search | timechart somethingorother | eventstats avg(*) as average(*)

That will add a field in the table / a line in your timechart graph called average(foo) for every field foo.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Now I'm sure I don't quite understand what you're ultimately trying to achieve.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...