Splunk Search

How to get average of all the summed values?

rakeshyv0807
Explorer

Hi,

I am trying to sum up all the field values grouped by a field value(suppose fieldA) in my initial query and I got a table format grouped by the fieldA and the sum adjacent to each fieldA values. Please refer to the sample below of what my result looks like for the query I run i.e. sourcetype="pfaduit" success NOT SLO NOT OIDC adapterid=* |stats sum(responsetime) as "Total transaction time" by tid

tid:--37c0eKuTSWXpY-UzVEk-jqiAY                           172
tid:--68NI1mHOZKHASRvcX7sAOr5wk                           1937
tid:--7MWVx1vxrdiM_JHAwfutRmhPM                           794
tid:--H5vkWYeGbKoaSGvWOoopV_4ls                           376
tid:--SG6xWW_efHRsWKkfkZBc-W4tk                           767
tid:--ehyUNfx6WAk87KRpUkPtfGznk                           234
tid:--geBC5RN3WRp6FSPG4NRBHNdPc                           642
tid:--ji7I3wuIJMue8OpxPgIuqpRcA                           772
tid:--kaI_bi5DqFevhT3am6D-IA6wA                           518
tid:--lDGH10oApyn_L1dMcaN_fZ1EM                           484

Now, I want to find the average of above values and get a single value as output and display it when I run this report. Can you please help me achieve it?

Thanks in advance.

0 Karma
1 Solution

davpx
Communicator
sourcetype="pfaduit" success NOT SLO NOT OIDC adapterid=* |stats sum(responsetime) as "Total transaction time" by tid | stats avg("Total transaction time") as "Average transaction time"

View solution in original post

davpx
Communicator
sourcetype="pfaduit" success NOT SLO NOT OIDC adapterid=* |stats sum(responsetime) as "Total transaction time" by tid | stats avg("Total transaction time") as "Average transaction time"
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...