Splunk Search
Highlighted

how can I calculate the average of field1,field2,field3 for users and display the average of each user?

Builder

I have a splunk result as below

user field1 field2 field3
A 5 8 3
B 2 3 5

Now how can I calculate the average of field1,field2,field3 for users and display the average of each user?

0 Karma
Highlighted

Re: how can I calculate the average of field1,field2,field3 for users and display the average of each user?

Motivator

Try this:

your query to return user, field1, field2, field3
| stats avg(field1) as avg1, avg(field2) as avg2, avg(field3) as avg3 by user
0 Karma
Highlighted

Re: how can I calculate the average of field1,field2,field3 for users and display the average of each user?

Splunk Employee
Splunk Employee

Hi pavanae,

You can use the eval function to create a new user-average field in your search command.

... | eval user-avg=(field1+field2+field3)/3

Hope this helps.
Thanks
Hunter

0 Karma
Highlighted

Re: how can I calculate the average of field1,field2,field3 for users and display the average of each user?

Esteemed Legend

Like this:

Your Base Search Here | stats avg(eval(field1+field2+field3)) AS all_avg BY user

View solution in original post

0 Karma