Splunk Search
Highlighted

total average number rather than average by field

Engager

I have the query set up to find the average duration per country. How would I get the query to find the total average duration of all the countries together?

0 Karma
Highlighted

Re: total average number rather than average by field

Champion

The community can best help you if you share the query or at least part of it. Please copy and paste what you can from the actual query.

0 Karma
Highlighted

Re: total average number rather than average by field

SplunkTrust
SplunkTrust

Without seeing your query, this is hard to say. But I'm betting you're using the BY clause to sort the average by country. Remove the BY COUNTRY to get the total average

0 Karma
Highlighted

Re: total average number rather than average by field

Splunk Employee
Splunk Employee

Hi andrwbn,

Either one of the following can help you get the total average duration of all countries:

  • Remove "by country" in our query
    Change:

    ... | stats avg(duration) by country

    To:

    ... | stats avg(duration)

  • Use the addcoltotals command to view both by-country averages and total averages at the same time

    ... | stats avg(duration) by country | addcoltotals
    Hope this helps. Thanks!
    Hunter

View solution in original post

0 Karma