Hello
I am trying to calculate the mean of a field and it's strange that splunk cal the mean in a completely different manner.
week A B mean(B)
1 41 1290 0 0.000000
2 42 1372 82 82.000000
3 43 81 1291 1291.000000
As you can see above the value is kind of wrong. The command which I used was
sourcetype=incident record.affectedCI="xxxx"| eval week=tonumber(strftime(_time,"%U")) | stats count by week | rename count as A |delta A as B | eval B=coalesce(B,0) | eval B = abs(B) | stats mean(B) by week A B
In my understanding of math it should have been (0+82+1291)/3 and it should have been the same value for all the weeks. Can anyone please let me know if I am missing something here.
Regards
theou
stats evaluates per-event, grouping by your differentiators (the by-clause). Try eventstats. In this case, an example invocation would be like this (replace the stats command at the end of your search):
| eventstats mean(B)
stats evaluates per-event, grouping by your differentiators (the by-clause). Try eventstats. In this case, an example invocation would be like this (replace the stats command at the end of your search):
| eventstats mean(B)
Ahaa.. Got it. I understand it now on why it messed it up. Thanks for the clarification.