Splunk Search

Stats count and average

rhinomike
Explorer

I have a log that more or less looks like:

 timestamp=1422006650  from=bob@sender.com to=alice@receiver.com subject="I love you honey" score=100 
 timestamp=1422007650    from=bob@sender.com to=alice@receiver.com subject="I love you honey" score=100 
 timestamp=1422008650    from=eve@sender.com to=alice@receiver.com subject="I loved him first" score=100
 timestamp=1422009650    from=eve@sender.com to=alice@receiver.com subject="I loved you first" score=50
 timestamp=1422009750    from=eve@sender.com to=alice@receiver.com subject="I loved him  first" score=10

I am now trying to perform a stats like

from                    subject                 count_to    avg_score
bob@sender.com          I love you honey       2       100
eve@sender.com          I loved you first      1       50
eve@sender.com          I loved him first      2       55

If I'm not mistaken, I can use:

stats count by from,to, subject to build the four first columns, however it is not clear to me how to calculate the average for a particular set of values in accordance with the first round of stats.

Is it possible?

Tags (1)
0 Karma
1 Solution

aweitzman
Motivator

This should work:

... | stats count as count_to avg(score) as avg_score by from subject

View solution in original post

0 Karma

aweitzman
Motivator

This should work:

... | stats count as count_to avg(score) as avg_score by from subject

0 Karma

rhinomike
Explorer

Solved it perfectly. Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...