Calculating Averages, Trend charts and displaying these in dashboards

[saurabhkunte]

hello,
I have following details which i am indexing to splunk from our Symantec DB via splunk dbconnect. This query runs daily to import the patching success data to Splunk. The example below lists the Microsoft patches compliance per server.

Server Compliance A.C I.C NI_C RR
qa-server01 100.00 4 4 0 No
qa-server02 100.00 5 5 0 No
qa-server01 85.71 7 6 1 No
qa-server03 100.00 5 5 0 No
qa-server05 100.00 5 5 0 No

the 1st line mentioned above are the field names that are automatically extracted by Splunk. I listed the output by just tabling these fields for easier reading.

I need follwing 2 information shown in the dashboard :

1) Calculate Avg percentage compliance of patches installed on the servers per week
For e.g dashboard should list 1st the avg compliance % of patches installed on servers per week ( now-7d)
Company Servers Weekly Patch Compliance Result = 95%
Followed by the trends charting of avg compliance % for the last 8 weeks broken down per week basis.

2) Same dashboard to show avg compliance % of patches installed on servers per month
Company Servers Monthly Patch Compliance Result = 95%
Followed by the trends charting of avg compliance % for the last 1 year broken down per month basis.

as a stage 2 I will then split my company servers based on the environments, DEV, QA Prod etc and have the above information fed to dashboards for each server environments.
I am hoping one you can help me out with this.

Thank you.

[lguinn2]

I sugggest:

yoursearchhere earliest=-7d@d latest=@d
| stats avg(Compliance) as AvgCompliance by Server

or what I think you want:

yoursearchhere earliest=-7d@d latest=@d
| stats avg(Compliance) as AvgCompliance

To do it by week:

yoursearchhere earliest=-8w@w latest=@w
| timechart span=1w avg(Compliance) as AvgCompliance

By month:

yoursearchhere earliest=-12m@m latest=@m
| timechart span=1m avg(Compliance) as AvgCompliance

[saurabhkunte]

Thanks a lot this search works. I also managed to split my servers into various environments for e.g DEV, QA Prod etc.

Could I please ask for a slight modification where its displays the compliance Percentages for all the environments per month ? Meaning :

Y axis has months - Jan, Feb Mar ... and X axis Plots the compliance percentage bar charts for every month ? Thanks again for your quick help.