First, the background - I have a number of events that are parsed and indexed. The format of the log file is: [timestamp] [Sub1] Name="Bob" Count=2 [Sub2] Name="Sarah" Count=5 [Sub1] Name="Sarah" Count=3 [Sub2] Name="Bob" Count=0 [timestamp] [Sub1] Name="Bob" Count=5 [Sub2] Name="Sarah" Count=3 [Sub1] Name="Sarah" Count=0 [Sub2] Name="Bob" Count=3 [timestamp] [Sub1] Name="Bob" Count=1 [Sub2] Name="Sarah" Count=2 [Sub1] Name="Sarah" Count=0 [Sub2] Name="Bob" Count=2 The [timestamp] is the start of a new event. Splunk splits these lines into their own events properly. The [Sub1] and [Sub2] tags denote different items in my system, so for now I am only wanting to use the fields that come after Sub1. I cannot determine what Search query to use that will search the indexed data, take the average of the Counts based upon [Sub1] and each "Name", and spit the results out. Does anyone have an idea on this? ... View more