Splunk Search
Highlighted

create a new column with average of a perticular field for every row

Engager

Hi All

I am trying to create a new column with the average of a field name (backpostduration) . I need to add this column to existing 2 columns.

backpostduration is the total response time for every request. ex: 11212 ms

1) URL ........xxxxxxxxxxxxx.com.au/checkout/multi/xxxxxxxxxNotificationHandler)
2) count ( total No. of occurrences of URL in specified time)
3) this is new column. (avg of backpostduration)

Sample log

Successful back-post to xxxxxxxxxxxxx.com.au/checkout/multi/xxxxxxxxxNotificationHandler in 11212 ms with response 404 Not Found.

right now i am using below , but unable to include the 3rd column

sourcetype=xxxxxxxxxxxxx | rex field=raw "back-post to (?<TOURL>\S+)" | stats count by TO_URL

0 Karma
Highlighted

Re: create a new column with average of a perticular field for every row

SplunkTrust
SplunkTrust

If you have backpostduration as a field, then try

<your query> | stats count as count,avg(back_post_duration) as Average by TO_URL

View solution in original post

Highlighted

Re: create a new column with average of a perticular field for every row

Engager

Thanks Ranjith. This worked.

0 Karma