Splunk Dev

How to average all columns in a chart for a group of results?

splunk_user_jk
New Member

Here's what I'm trying to do:

Imagine a search result from Splunk comes back with results:

User | Field 1 | Field 2 | Field 3 | Field 4


A | 1 | 0 | 1 | 2
B | 3 | 0 | 1 | 1
C | 0 | 0 | 0 | 0

Desired Result:
A chart

Field 1 | Field 2 | Field 3 | Field 4

1.33 | 0 | .666 | 1

So the goal is to get the average User's value for each field.

Tags (1)
0 Karma

Vijeta
Influencer

You could do it

index=<index name>| stats avg(Field1) as Field1, avg(Field2) as Field2, avg(Field3) as Field3, avg(Field4) as Field4
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...