Splunk Search

calculating average that depends on the value of one field

almond14
Engager

I have this list of events:
1. dir=up, time=60, speed=12, weight=92
2. dir=down, time=54, speed=16, weight=32
3. dir=up, time=69, speed=10, weight=66
4. dir=up, time=99, speed=84, weight=47
5. dir=down, time=66, speed=88, weight=11
6. dir=up, time=17, speed=62, weight=82
etc

How do I create a chart/table with these columns:
<average time (up)> < average time (down)> <average speed (up)> <average speed (down)> <average weight (up)> <average weight (down)>

0 Karma
1 Solution

jplumsdaine22
Influencer

Something like this should give you what you're after

<your search> | eventstats avg(time) as avgtime avg(speed) as avgspeed avg(weight) as avgweight by dir | dedup dir |eval avgtime_{dir}=avgtime | eval avgspeed_{dir}=avgspeed | eval avgweight_{dir}=avgweight  | chart values(avg*) as avg*

View solution in original post

jplumsdaine22
Influencer

Something like this should give you what you're after

<your search> | eventstats avg(time) as avgtime avg(speed) as avgspeed avg(weight) as avgweight by dir | dedup dir |eval avgtime_{dir}=avgtime | eval avgspeed_{dir}=avgspeed | eval avgweight_{dir}=avgweight  | chart values(avg*) as avg*

stephanefotso
Motivator

Hello. Try this:

index=....... dir="up"|stats sum(time) as sum_time_up sum(speed) as sum_speed_up sum(weight) as sum_weight_up|eval average_time_up=time/sum_time_up|eval average_speed_up=speed/sum_speed_up|eval average_weight_up=weight/sum_weight_up|join [search index=... dir="down"|stats sum(time) as sum_time_down sum(speed) as sum_speed_down sum(weight) as sum_weight_down|eval average_time_down=time/sum_time_down|eval average_speed_down=speed/sum_speed_down|eval average_weight_down=weight/sum_weight_down]|table  average_time_up  average_time_down  average_speed_up average_speed_down average_weight_up average_weight_down

Thanks

SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...