Splunk Search

Calculate avg , min , max for per multivalue field

yuwtennis
Communicator

Hi !

I would like to ask question whether following calculation is possible or not?
For following case,

customer type amount
A a 10
A a 20
A b 10
B a 5
B a 10

I want to calculate fields as

customer type count min max avg
A a 2 10 20 15
b 1 10 10 10
B a 2 5 10 7.5

However, I have tried that

stats values(type) , count, min(amount), max(amount), avg(amount) by customer

does not work...

I would appreciate if someone can help me out with this issue.

Thanks,
Yu

Tags (2)
0 Karma

rturk
Builder

Hi Yutennis,

Putting your data into a lookup tennis.csv:

customer,type,amount
A, a, 10
A, a, 20
A, b, 10
B, a, 5
B, a, 10

I used the search:

| inputlookup tennis.csv | stats count, max(amount), min(amount), avg(amount) by customer, type

Which gave me this:

alt text

Hope this of some help! 🙂

0 Karma

rturk
Builder

No problems Yu - Please accept Hiroshi's answer so other people can find the solution.

いいえ問題は - 他の人が解決策を見つけることができるように Hiroshi's の答えを受け入れてくださいませ

(Thanks Google translate!)

0 Karma

yuwtennis
Communicator

Hello R.Turk.

Thank you for the reply.
I was not aware that you can specify multiple fields in stats!

The result came out the way I wanted .

Thanks
Yu

0 Karma

rturk
Builder

Sorry I didn't see Hiroshi's earlier answer - please accept his answer 🙂

0 Karma

HiroshiSatoh
Champion

The result is useless or in the following?Please let me know if there is something objective.

stats count, min(amount), max(amount), avg(amount) by customer,type
customer type count min max avg
A a 2 10 20 15
A b 1 10 10 10
B a 2 5 10 7.5

HiroshiSatoh
Champion

これはもう解決したと思ってよいか?
Is it may be considered to have resolved this anymore?

サンプルに近いフォーマットならこんな感じになると思う。
I think to be a feeling that if format close to the sample.

・・・ | stats count as count, min(amount) as min, max(amount) as max, avg(amount) as avg by customer,type|stats list(type) as type,list(count) as count,list(min) as min,list(max) as max,list(avg) as avg by customer

0 Karma

yuwtennis
Communicator

Hello Hiroshi.

回答ありがとうございます。

以下のような結果を出したいです。

ex1:
customer type amount
A a 10
A a 10
A a 10
A b 10
B b 20
B c 10
C a 10

res1:
customer type avg min max
A a 10 10 10
b 10 10 10
B b 20 20 20
c 10 10 10
C a 10 10 10

以上です。

0 Karma

HiroshiSatoh
Champion

Hi. yuwtennis.I also love tennis.

もう少しバリエーションをふやして結果のイメージを提供してもらえませんか?

Could you provide an image of the result by increasing the variation a little more?

0 Karma

yuwtennis
Communicator

customer 別 に type の値を計算したいのですが、
どうもうまくいかないみたいで。。。もし、
解決方法をご教示いただけると幸いです。

0 Karma

yuwtennis
Communicator

Hello Hiroshi.

My goal is to calculate the stats (max, min , avg) by type per customer.
I believe just simply specifying "by" statement in stats groups by
type regardless of customer.

So if something like ,

stats ( count by type ) by customer

can happen, I can achieve my goal.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...