Splunk Search

average for sucessfully requests

chialin
New Member

Hi, I hava data in the log like the following:

userId    url     status    time
123       /abc    success   1000
123       /abc    failed    100000
234       /abc    success   1200

I would like to generate a report that returns

  1. total # of requests
  2. average time for sucessful requests

How can I achieve this with stats and other Splunk functions?

Tags (1)
0 Karma

dsheldon
Explorer

Using a single search:

index=foo | eval time_success=if(status="success",time,"") | stats COUNT(status) AS "Total Requests" AVG(time_success) AS "Average time - Success"

"time_success" stores only the values that should be averaged together. The stats command is then used to calculate both the total count and the average time of success

kristian_kolb
Ultra Champion
  1. index=blah sourcetype=bleh | stats count AS "Total Requests"

  2. index=blah sourcetype=bleh status=success | stats avg(time) AS "Avg time - successful"

If you want the result in one search, you can use the append search command. See the docs.

/K

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...