×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ermosk
Engager
Member since: ‎05-07-2015
‎06-05-2020
Community Statistics
Posts 6
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎05-07-2015
Activity Feed
View All

Re: Ignore empty data point when calculating avera...

by in Splunk Search
‎05-07-2015 07:00 AM
‎05-07-2015 07:00 AM
Using fillnull value=NULL seems to ignore any columns that have NULL in them. ... View more

Re: Ignore empty data point when calculating avera...

by in Splunk Search
‎05-07-2015 06:34 AM
‎05-07-2015 06:34 AM
So this introduces a new issue because I don't know beforehand how many of these time_svc_agg will exist, nor their names. Will I need a subquery to take care of this? ... View more

Re: Ignore empty data point when calculating avera...

by in Splunk Search
‎05-07-2015 06:19 AM
‎05-07-2015 06:19 AM
I encapsulated them in $$ (like eval avg_=$sum_$/$count_*$ ) but I still cant see any new columns with avg_ in my table ... View more

Re: Ignore empty data point when calculating avera...

by in Splunk Search
‎05-07-2015 06:14 AM
‎05-07-2015 06:14 AM
It's quite simple really. Looking at the table I can clearly see what the result should be. Just adding the avg function causes it go off. ... View more

Re: Ignore empty data point when calculating avera...

by in Splunk Search
‎05-07-2015 06:12 AM
‎05-07-2015 06:12 AM
I like this approach but I can't get it to work. I get the following error: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '/count_*'. Here is how my search currently looks Some initial event filtering | table time_svc_agg* | stats count(time_svc_agg_) AS count_, sum(time_svc_agg_) AS sum_ | eval avg_=sum_/count_* ... View more

Ignore empty data point when calculating average

by in Splunk Search
‎05-07-2015 04:51 AM
‎05-07-2015 04:51 AM
I am trying to calculate the average for a few columns and rows but I have came across the following issue. Some rows might not have data for a particular column, but it seems these are still taken into account when calculating the avg for this column which means the data is way off. I'd like my formula to ignore a data point (if not present) when calculating the average for the column. Here is my formula : table ABC* | stats avg(ABC_*) So if I have something like : Column : ABC_1 | ABC_2 | ABC_3 | ABC_4 | ABC_5 1 2 1 2 2 2 2 1 1 2 3 The average for column ABC_2, ABC_4 and ABC_5 is incorrect. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma given to
View All