Splunk Search

Raw data into calculation.

axl88
Communicator

Timestamp: 1/21/2014 9:40:08 Number of records : 1 Total Size of the records : 1481

Timestamp: 1/21/2014 3:22:06 Number of records : 6 Total Size of the records : 13032

Timestamp: 1/22/2014 7:12:41 Number of records : 1 Total Size of the records : 2573

Above is a sample from my data after I listed the indexes I need. I need to find daily averages of the both columns. I felt the problem is ":" that I need equal sign instead. I accept the fact that this probably a real newbie on question, thanks for your time.

0 Karma
1 Solution

kristian_kolb
Ultra Champion

The easiest way to try this out is to do it via rex, which extracts these field for the duration of the search. I.e. the configuration is not stored in any config file:

your search for events | rex "Number\sof\records\s+:\s+(?<rec_num>\d+)\s+Total Size of records\s+:\s+(?<rec_size>\d+) | timechart span=1d avg(rec_num) avg(rec_size)

/K

View solution in original post

kristian_kolb
Ultra Champion

The easiest way to try this out is to do it via rex, which extracts these field for the duration of the search. I.e. the configuration is not stored in any config file:

your search for events | rex "Number\sof\records\s+:\s+(?<rec_num>\d+)\s+Total Size of records\s+:\s+(?<rec_size>\d+) | timechart span=1d avg(rec_num) avg(rec_size)

/K

axl88
Communicator

Thanks for the answer. With little modification, it worked fine for me. IFX tool was really helpful on making these modifications.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First you'll need to extract the two numbers into fields: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields
Second you'll need to send those fields into a timechart, something like this:

your query producing fields foo and bar | timechart span=1d avg(foo) as foo_average avg(bar) as bar_average

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart for reference.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...