Comments and answers for "Calculate Average for multiple fields"
https://answers.splunk.com/answers/174674/calculate-average-for-multiple-fields.html
The latest comments and answers for the question "Calculate Average for multiple fields"Comment by Brittany_Carr on Brittany_Carr's answer
https://answers.splunk.com/comments/176530/view.html
This answer was really close to answering my question. The foreach really helped me out. Here is what ended up working for me
...| stats count(intEl*) sum(intEl*)
| eval intEl_count = 0
| foreach count* [eval intEl_count = intEl_count + '<>']
| eval intEl_sum = 0
| foreach sum* [eval intEl_sum = intEl_sum + '<>']
| eval AverageIntEl = intEl_sum / intEl_count
| fields - field_*Mon, 20 Oct 2014 20:20:05 GMTBrittany_CarrAnswer by martin_mueller
https://answers.splunk.com/answering/174678/view.html
I believe Somesh's answer would actually produce the sum of averages (or an average of sums?) rather than the overall average. Give this a shot:
... | eval field_count = 0 | eval field_sum = 0
| foreach intEl* [eval field_count = field_count + 1 | eval field_sum = field_sum + '<<FIELD>>']
| stats sum(field_sum) as field_sum sum(field_count) as field_count
| eval AverageintEl = field_sum / field_count | fields - field_*
This will build a sum and a counter in lock step, giving you the input needed to calculate the average over any number of fields.Fri, 17 Oct 2014 22:52:03 GMTmartin_muellerAnswer by somesoni2
https://answers.splunk.com/answering/173714/view.html
Give this a try
your base search | addtotals fieldname=intEl intEl* | stats avg(intEl)Fri, 17 Oct 2014 21:38:40 GMTsomesoni2