I have a splunk result as below
user field1 field2 field3
A 5 8 3
B 2 3 5
Now how can I calculate the average of field1,field2,field3 for users and display the average of each user?
Like this:
Your Base Search Here | stats avg(eval(field1+field2+field3)) AS all_avg BY user
Like this:
Your Base Search Here | stats avg(eval(field1+field2+field3)) AS all_avg BY user
Hi pavanae,
You can use the eval function to create a new user-average field in your search command.
... | eval user-avg=(field1+field2+field3)/3
Hope this helps.
Thanks
Hunter
Try this:
your query to return user, field1, field2, field3
| stats avg(field1) as avg1, avg(field2) as avg2, avg(field3) as avg3 by user