Hi,
as I can see in the Splunk docs, using | stats avg() and mean() shoud both give me the same results (arithmetic mean).
In my query I search for both of avg and mean. But I am only getting results for mean, not for average.
My search query is like this |index=x searchtype=x| stats avg() mean()
Why are there no results for average? Does average only work if Splunk automatically aggregates values for example to create the average of 5 min chunks? And mean takes all values and divides it by the total count?
Thank you!
Silvia
There is indeed no difference between the two, however I've noticed that Splunk only spits out results for one of them when they are averaging the same field. (Which makes sense, since why do twice the work for the same result). For example this search:
|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2 = value | stats avg(val2) mean(value)
Spits our values for both but this search:
|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | stats avg(value) mean(value)
Spits out a value for only one of them
Is that your actual search? If so, the problem is that you need to tell Splunk what field
to average by putting something inside the parentheses like this:
index=x sourcetype=x| stats avg(x) mean(x)
I have NEVER seen avg not work and I use it almost every day! If you are putting a field
inside avg()
then the answer is that the field you are telling Splunk to avg
does not have any values for the search you are using.
This isn't the problem. | stats avg
is the same as | stats avg(*)
which is spit out averages of all numeric fields. Example search:
|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2=value | stats avg
There is indeed no difference between the two, however I've noticed that Splunk only spits out results for one of them when they are averaging the same field. (Which makes sense, since why do twice the work for the same result). For example this search:
|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | eval val2 = value | stats avg(val2) mean(value)
Spits our values for both but this search:
|noop | stats count | fields | eval value=mvrange(1,10) | mvexpand value | stats avg(value) mean(value)
Spits out a value for only one of them
Oh - thank you. That makes sense.