Splunk Search

Advanced search for average and greater than

gagi76
New Member

Hi,

can someone point me to the advanced search. I need to search for transactions from current day that are greater than average from last month?
For now i have starting search for average from last month... and don't know how to proceed further.

earliest="04/01/2016:00:00:00" latest="04/30/2016:23:59:59" | stats avg(Price)
Tags (4)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Something like this

index=yourindex sourcetype=yoursourcetype earliest=@d latest=now | where Price> [search index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon | stats avg(Price) as avg | return $avg ]  | table ..put required fields here...

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this

index=yourindex sourcetype=yoursourcetype earliest=@d latest=now | where Price> [search index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon | stats avg(Price) as avg | return $avg ]  | table ..put required fields here...
0 Karma

gagi76
New Member

Great, thanks! Actually it worked with this one:

yoursourcetype earliest=@d latest=now | where Price > [search  earliest=-1mon@mon latest=@mon | stats avg(Price) as avg | return $avg ]  | table ..put required fields here...
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...