Splunk Search

create a new column with average of a perticular field for every row

sukundur
Engager

Hi All

I am trying to create a new column with the average of a field name (back_post_duration) . I need to add this column to existing 2 columns.

back_post_duration is the total response time for every request. ex: 11212 ms

1) URL ........xxxxxxxxxxxxx.com.au/checkout/multi/xxxxxxxxxNotificationHandler)
2) count ( total No. of occurrences of URL in specified time)
3) this is new column. (avg of back_post_duration)

Sample log

Successful back-post to xxxxxxxxxxxxx.com.au/checkout/multi/xxxxxxxxxNotificationHandler in 11212 ms with response 404 Not Found.

right now i am using below , but unable to include the 3rd column

sourcetype=xxxxxxxxxxxxx | rex field=_raw "back-post to (?<TO_URL>\S+)" | stats count by TO_URL

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

If you have back_post_duration as a field, then try

<your query> | stats count as count,avg(back_post_duration) as Average by TO_URL

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

If you have back_post_duration as a field, then try

<your query> | stats count as count,avg(back_post_duration) as Average by TO_URL

View solution in original post

sukundur
Engager

Thanks Ranjith. This worked.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!