Splunk Search

can we take the sum of numbers in a field using eval ??

rakesh_498115
Motivator

Hi

i have a field say A with values as below.

A

10
20
30

i have used the eval function like this .. eval RES= ( sum(A)/mvcount(A)) . but it didnt work ?? i need to take the avg of these values .. how can i do it using eval without using stats avg function ...

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

Note that an eval only works on fields in a single event. That means that unless field A is multi-value in a single event, something like mvcount(A) will only ever be one (1). If you use eventstats as described below, then the total (or other values) can be carried per event, and would then be in play for an eval statement.

0 Karma

reed_kelly
Contributor

I think you are trying to avoid aggregation while still computing aggregate fields. Use the eventstats command to get the best of both worlds:

|eventstats avg(A) as average_A

This adds an average_A field to every result.

0 Karma

reed_kelly
Contributor

By the way, if you still want to use eval, you can combine the two:

|eventstats sum(A) as suma, count |eval avgA = suma/count

0 Karma

sdaniels
Splunk Employee
Splunk Employee

why do you need to do it without using stats?

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...