Splunk Search

timechart avg vs count

bowa
Path Finder

I would use the example on this page as the base for my question:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration)

Averages are great ... but if there is a spike i would like to know the size of the sample the average was taken over.

So i would like to add to this timechart also the count of the number of transactions in that timeframe.

Anyone know if this is possible ?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

The transaction command produces two fields, duration and eventcount. You could use eventcount in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount)

View solution in original post

Ayn
Legend

The transaction command produces two fields, duration and eventcount. You could use eventcount in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount)

bowa
Path Finder

Thanks a lot ! exactly what i needed

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...