Splunk Search

eval returns a field rather than a scalar

riley_lewis
Loves-to-Learn Lots

When I do this search:

index="mydata" | eval mymean=avg(floatnumbers) | table floatnumbers,mymean

mymean just mimics whatever is in floatnumbers. How do I calculate the mean? I have tried the fieldsummary command, but when I did that, it would not port to chart correctly.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @riley_lewis,

the avg function must be used in a streaming command as stats or timechart:

index="mydata" 
| stats avg(floatnumbers) AS floatnumbers BY mymean

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...