Looking to take the following data sample and average the Latency columns based off the matching of Out and In fields. I've already taken the main search string and built reports around a rt timechart of average sorted by either Out or In; but would like a report that would show the average over 1 hr by distinct In & Out uniqueness
Example:
Latency, In, Out
00:00:01 SourceA SourceB
00:00:40 SourceA SourceC
00:00:01 SourceA SourceB
00:00:01 SourceB SourceB
00:00:01 SourceA SourceC
00:00:02 SourceA SourceC
00:00:01 SourceA SourceB
00:00:01 SourceA SourceB
00:00:01 SourceB SourceA
00:00:01 SourceA SourceB
00:00:30 SourceB SourceC
I've already taken the main search string and built reports around a rt average sorted by either Out or In.
Would like it to look for any "In" and "Out" match them up and calculate the average of each one. With the above example it would be:
00:00:01 SourceA SourceB
00:00:01 SourceA SourceB
00:00:01 SourceA SourceB
00:00:01 SourceA SourceB
00:00:01 SourceA SourceB
00:00:01 SourceB SourceB
00:00:01 SourceA SourceC
00:00:02 SourceA SourceC
00:00:40 SourceA SourceC
00:00:01 SourceB SourceA
00:00:30 SourceB SourceC
Result Table desired outcome:
Latency, In, Out
00:00:01, SourceA, SourceB
00:00:01, SourceB, SourceB
00:00:14, SourceA, SourceC
00:00:01. SourceB, SourceA
00:00:30, SourceB, SourceC
I would also be performing the same eval of Latency to show the max but figure that would be a simple change of performing the above by using max( ) instead of avg( ).
Hopefully this makes sense.
Best Regards,
Why not
yoursearchhere
| latInSec = strptime(Latency,"%H:%M:%S")
| stats avg(latInSec) by In Out
| eval Average_Latency = tostring(latInSec,"duration")
| fields - latInSec
Why not
yoursearchhere
| latInSec = strptime(Latency,"%H:%M:%S")
| stats avg(latInSec) by In Out
| eval Average_Latency = tostring(latInSec,"duration")
| fields - latInSec
Thanks worked great, though I did take out the time format conversion as its done prior. Guess the stats is the main function to perform a calculations based on grouping of other fields I was looking for.