Splunk Search

Display Avg Column

signpriya82
New Member

sourcetype="email_process" | eval processing_time_in_seconds = processing_time/1000 | table email, processing_time ,processing_time_seconds | chart sum(processing_time_seconds), count(processing_time) by email

The output of this is

email sum(processing_time_seconds) count(processing_time)
a@xx.com 1000 2
b@xx.com 2000 10

I would like to add another column called average_time that lists average_time for each email. Note average_time=sum(processing_time_seconds) / count(processing_time)

Desired output
email sum(processing_time_seconds) count(processing_time) Avg_Time_millisecond
a@xx.com 1000 2 500
b@xx.com 2000 10 200

Tags (4)
0 Karma

niketn
Legend

As per your example, all you need to do is add | eval Avg=Total/Count to your existing query. PS: I have renamed fields for easy use in Splunk query and also for readability. If you need column names same as what you have specified you can
1) Either use single quotes to escape special characters in the field name (for the field names in your query)
2) or else use rename command to rename fields to what you need.

 sourcetype="email_process" 
| eval processing_time_in_seconds = processing_time/1000 
| table email, processing_time ,processing_time_seconds 
| chart sum(processing_time_seconds) as Total, count(processing_time) as Count by email
| eval Avg=Total/Count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@signpriya82... Did this answer or something else worked out for you?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...