Splunk Search

calculating average that depends on the value of one field

Engager

I have this list of events:
1. dir=up, time=60, speed=12, weight=92
2. dir=down, time=54, speed=16, weight=32
3. dir=up, time=69, speed=10, weight=66
4. dir=up, time=99, speed=84, weight=47
5. dir=down, time=66, speed=88, weight=11
6. dir=up, time=17, speed=62, weight=82
etc

How do I create a chart/table with these columns:
<average time (up)> < average time (down)> <average speed (up)> <average speed (down)> <average weight (up)> <average weight (down)>

0 Karma
1 Solution

Influencer

Something like this should give you what you're after

<your search> | eventstats avg(time) as avgtime avg(speed) as avgspeed avg(weight) as avgweight by dir | dedup dir |eval avgtime_{dir}=avgtime | eval avgspeed_{dir}=avgspeed | eval avgweight_{dir}=avgweight  | chart values(avg*) as avg*

View solution in original post

Influencer

Something like this should give you what you're after

<your search> | eventstats avg(time) as avgtime avg(speed) as avgspeed avg(weight) as avgweight by dir | dedup dir |eval avgtime_{dir}=avgtime | eval avgspeed_{dir}=avgspeed | eval avgweight_{dir}=avgweight  | chart values(avg*) as avg*

View solution in original post

Motivator

Hello. Try this:

index=....... dir="up"|stats sum(time) as sum_time_up sum(speed) as sum_speed_up sum(weight) as sum_weight_up|eval average_time_up=time/sum_time_up|eval average_speed_up=speed/sum_speed_up|eval average_weight_up=weight/sum_weight_up|join [search index=... dir="down"|stats sum(time) as sum_time_down sum(speed) as sum_speed_down sum(weight) as sum_weight_down|eval average_time_down=time/sum_time_down|eval average_speed_down=speed/sum_speed_down|eval average_weight_down=weight/sum_weight_down]|table  average_time_up  average_time_down  average_speed_up average_speed_down average_weight_up average_weight_down

Thanks

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!