avg(count) will give you an average of the number of raw events, but you have to do some additional work with "bucket" and "streamstats". See http://answers.splunk.com/answers/79026/average-count-by-day for more info on that. If you want the average of a field, then you'll need to do "avg(fieldname)" to get the average of that value. This sounds like what you want to do, but it's a bit hard to tell exactly what given the way you formatted the query. And few example lines of data and the field name you want to average will go along way to help us help you. ... View more

Two ways to do this: Easiest way would be to just search for lines that contain the "elapsed time" value in it and chart those values. You can extract the elapsed time with a regular expression: "finished executing normally" | rex field=_raw "elapsed time (?<myduration>.*\s)seconds " | chart avg(myduration) If you have multiple process names, you could extract the process name into a field as well and add that into your chart: "finished executing normally" | rex field=_raw "Process (?<processName>\w+)" | rex field=_raw "elapsed time (? .*\s)seconds " | chart avg(myDuration) by processName Of course, use "timechart" instead of "chart" if you want to see the distribution of durations over time. Also. "timechart" does not require the use of a statistical function, but as Ayn points out if you have multiple events occuring during a given time slice on that you will still need to use a stat function. Probably your best bet on this type of data is to use "table" instead of "chart" or "timechart". ... View more

Odd way to look at data... Why not do the table by Field ID, with columns for Avg, Median, and Sparkline? ... View more

I would use the following: index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now NOT host=abc18 NOT host=abc19 There's not a need to run a second search via the | operator, just go ahead and filter out those hosts in the first search command. ... View more

Using "append" will give you a two charts side by side with the timeframe repeated. If you use "appendcols" instead, it will give you the results of both charts within one timeframe (overlapping instead of side by side). ... View more

See my update for further details for your situation. ... View more

Define your base search just as you have: source="C:\logs\path*.log" | chart count over http_status_code Create an Advanced Conditional Alert to "Trigger if" field value of "Custom condition is met" and enter the follow for the condition text: search http_status_code=401 | search count >= 1 I think that should work, but you might have to tweak it a bit. ... View more

According to: http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Listofpretrainedsourcetypes your log file will need to be in NCSA format. If you can see the HTTP log results in Splunk at all, look at the "source_type" field and see if Splunk matched it against one of the predefined types listed in the document linked to above. If "source_type" is not a field included as a part of each event in the search results, then use the list of fields on the left to "Select and show in results" to add that field to the results. You can also see all of the values that the "source_type" contains from the field list on the left as well. ... View more

Without a larger data set to look at, and without more details about what you want, it's hard to provide direction. You could do a chart that provides the SUM or AVG (average) Phase_End_Time for each Phase_Info value, but just plotting the End Time values for the Phase_Info values isn't going to provide you any value over a table of the results. ... View more

Thanks Kristian. I updated my answer to focus on the field usage in the stats command. It was a bad example. I was trying to break down what I thought was wrong into different parts. ... View more

Note my comment at the end of the answer: ""stats" wants to do calculations on fields, so I provided the "average" value for mytime in the query above. Because this you may want to use "table" instead of "stats"." ... View more

Insted of using "top fieldX", for the reasons stated by Ayn, use the following to see the maximum value in fieldX: mysearch | stats max(fieldX) ... View more

First thing to do is to replace the < and > characters with "<" and ">" before displaying in the web page. That assumes though that you can preprocess the XML before adding it to the HTML page. It's also likely a good idea to wrap the XML text in a <p></p> tag set to retain the format / spacing of the XML for display purposes. Update: Follow the same instructions above, but also wrap your XML in standard HTML tags, don't forget the <p> tags too, and then save the data to an .html file. ... View more

When you say "the ability to view an XML within a webpage view", do you mean a page within Splunk? I'm guessing yes, but which type of page? A dashboard or report? Or inline in the search results view? Or in a search results table view? ... View more

Get Dev License: http://dev.splunk.com/ Docs: http://docs.splunk.com This site (congrats as you are already here) The Splunk Book - Free at - http://www.splunk.com/goto/book If you have money to spend, the Splunk Conference first week of Oct. http://conf.splunk.com ... View more

If you select to view the data as a table instead of a chart (using the buttons just above and to the left of the chart), do the columns in the table represent 1 day or 2 day periods? If 1 day then the data is correct but something is skewing your chart view, such as screen resolution / browser window size... ... View more

What is the time span for your search? If it is too large to display the data at 1 day per column (for example) then it will combine the columns to cover multiple days. A smaller time span will likely change the chart to display the data as you like. (Of course, you might already know this or are having other issues.) The other thing you can do is to filter the results to show only the results where the value is above a certain threshold to reduce the amount of noise in the chart. ... View more