Splunk Search

Display Avg Column

signpriya82
New Member

sourcetype="email_process" | eval processing_time_in_seconds = processing_time/1000 | table email, processing_time ,processing_time_seconds | chart sum(processing_time_seconds), count(processing_time) by email

The output of this is

email sum(processing_time_seconds) count(processing_time)
a@xx.com 1000 2
b@xx.com 2000 10

I would like to add another column called average_time that lists average_time for each email. Note average_time=sum(processing_time_seconds) / count(processing_time)

Desired output
email sum(processing_time_seconds) count(processing_time) Avg_Time_millisecond
a@xx.com 1000 2 500
b@xx.com 2000 10 200

Tags (4)
0 Karma

niketn
Legend

As per your example, all you need to do is add | eval Avg=Total/Count to your existing query. PS: I have renamed fields for easy use in Splunk query and also for readability. If you need column names same as what you have specified you can
1) Either use single quotes to escape special characters in the field name (for the field names in your query)
2) or else use rename command to rename fields to what you need.

 sourcetype="email_process" 
| eval processing_time_in_seconds = processing_time/1000 
| table email, processing_time ,processing_time_seconds 
| chart sum(processing_time_seconds) as Total, count(processing_time) as Count by email
| eval Avg=Total/Count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@signpriya82... Did this answer or something else worked out for you?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...