Comments and answers for "How to calculate the average for all values in a single column?"
https://answers.splunk.com/answers/395060/how-to-calculate-the-average-for-all-values-in-a-s.html
The latest comments and answers for the question "How to calculate the average for all values in a single column?"Comment by jperezes on jperezes's comment
https://answers.splunk.com/comments/498552/view.html
I am trying to do something similar, but this solution is not working to me.
avg(totalTime) returns totalTime as it is the average of a single value. So I end up with a table for total times by user instead of the average by user.
I had to add the total number of occurrences and at the end divide the total value for the number of occurrences per user.
rgds,
JuanFri, 10 Feb 2017 20:13:26 GMTjperezesComment by jpolcari on jpolcari's comment
https://answers.splunk.com/comments/395071/view.html
That is what I was hoping for. Maybe one day!Wed, 20 Apr 2016 14:57:18 GMTjpolcariComment by ddrillic
https://answers.splunk.com/comments/395070/view.html
You would think that there would be a "family" of commands similar to addcoltotals, such as addcolaverage...Wed, 20 Apr 2016 14:52:00 GMTddrillicComment by jpolcari on jpolcari's answer
https://answers.splunk.com/comments/395065/view.html
Thank you! That is exactly what I needed.Wed, 20 Apr 2016 14:06:10 GMTjpolcariAnswer by lguinn2
https://answers.splunk.com/answering/396055/view.html
You can do it like this
yoursearchhere
| stats sum(Time) as totalTime by User
| appendpipe [ stats avg(totalTime) as totalTime | eval User = "Average Time" ]
| rename totalTime as "Time (Hours)"
The `appendpipe` commands examines the results in the pipeline, and in this case, calculates an average. The results of the `appendpipe` command are added to the end of the existing results. Notice that I used the same field names within the `appendpipe` command, so that the new results would align in the same columns.Wed, 20 Apr 2016 14:01:14 GMTlguinn2