Answers for "Calculate Average for multiple fields"
https://answers.splunk.com/answers/174674/calculate-average-for-multiple-fields.html
The latest answers for the question "Calculate Average for multiple fields"Answer by martin_mueller
https://answers.splunk.com/answering/174678/view.html
I believe Somesh's answer would actually produce the sum of averages (or an average of sums?) rather than the overall average. Give this a shot:
... | eval field_count = 0 | eval field_sum = 0
| foreach intEl* [eval field_count = field_count + 1 | eval field_sum = field_sum + '<<FIELD>>']
| stats sum(field_sum) as field_sum sum(field_count) as field_count
| eval AverageintEl = field_sum / field_count | fields - field_*
This will build a sum and a counter in lock step, giving you the input needed to calculate the average over any number of fields.Fri, 17 Oct 2014 22:52:03 GMTmartin_muellerAnswer by somesoni2
https://answers.splunk.com/answering/173714/view.html
Give this a try
your base search | addtotals fieldname=intEl intEl* | stats avg(intEl)Fri, 17 Oct 2014 21:38:40 GMTsomesoni2