×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
a356115
New Member
Member since: ‎05-05-2011
‎06-05-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎05-05-2011
View All

Re: problem computing 2 sums in one search for 1 t...

by in Splunk Search
‎09-19-2011 09:11 AM
‎09-19-2011 09:11 AM
acdevlin. That's excellent !! Thanks very much for your persistence. I've learned a lot from this and it really helps me with my work. I wanted it in this format as I'm displaying the information as a data table to provide managers a one-line, high level overview of the stats. Basically, it allows me display more information in one table rather than having to have lots of different tables (one per call type). I think its a tricky enough solution for what 'should be' a fairly straight forward query but obviously by lack of splunk experience doesn't help Thanks again !! ... View more

Re: problem computing 2 sums in one search for 1 t...

by in Splunk Search
‎09-16-2011 08:33 AM
‎09-16-2011 08:33 AM
Hi acdevlin. The sample query you built wont work because I need a one line data table showing the 2 average values. I would have thought something like this should be simple to do. Its just 2 average value computations which need to use a where caluse. So output data table should look like: value1 = average of (summed values where ct=1) and value2 = average of (summed values where ct=2). Maybe its just not possible...? (I am new to Splunk) ... View more

Re: problem computing 2 sums in one search for 1 t...

by in Splunk Search
‎09-15-2011 06:36 AM
‎09-15-2011 06:36 AM
Still not working. I need a search query that will return me 2 values in one row on a table. These values should be the average of 4 numbers summed over all events. An input event contains 5 numbers. The first number in the event, can be a 1 or a 2. Using all the input events, the first value is the average of the last 4 numbers when the first value is 1 and the second number is the average of the last 4 numbers when the first value in the event line is a 2. The problem is when I use a 'where' clause it automatically deletes all event that are false and so I cant compute my 2nd value. ... View more

Re: problem computing 2 sums in one search for 1 t...

by in Splunk Search
‎09-14-2011 04:50 AM
‎09-14-2011 04:50 AM
Thanks Draineh. I tried to simplify my problem to make it clearer but probably confused things. What I actually need to get is 2 averages. 1 average (q1+q2+q3+q4) where ct=1 and 1 where ct=2 and display these 2 average values in one table row. I dont know how to use the where clause to do this... I would be grateful for any help. ... View more

problem computing 2 sums in one search for 1 table...

by in Splunk Search
‎09-14-2011 02:59 AM
‎09-14-2011 02:59 AM
I have the following multiple events: date=08/07/11 time=14:58:29 app=surveyStartCall ct=1 q1=8 q2=5 q3=5 q4=5 date=08/07/11 time=14:58:30 app=surveyStartCall ct=2 q1=1 q2=5 q3=5 q4=5 ....... and want my search to return 2 values depending on the ct variable (ct can only equal 1 or 2) value1 = average of (q1+q2+q3+q4) for all events where ct=1 and value2 = average of (q1+q2+q3+q4) for all events where ct=2 However, I cant seem to get this returned in 1 table row (has to be one row). I tried eval with a by clause and tried append search but they all give 2 table rows. A 'where' clause will not work as it deletes all events for which the where is false so I cant get my second value. Can anyone help please ? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM