Splunk Search

How to find the average of daily indexed data by host for a given time range and show all hosts on a timechart, not just the top 10?

jodros
Builder

I have a search that utilizes timechart to sum the total amount of data indexed by host with 1 day span. I would like to know how to get the an average of the daily sum for each host.

Also, I am using timechart, but it groups everything that is not the top 10 into others category. Is there anyway to show all results, or utilize stats for this calculation?

Any assistance would be appreciated.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Assuming you just want a daily average, you can do this:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | stats sum(GB) as total by series | addinfo | eval days = (info_max_time - info_min_time) / 86400 | fields - info* | eval daily_average = total / days

That's throwing out your timechart entirely. If you somehow want the daily average appended to your timechart you can do this:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1d limit=0 | appendpipe [stats avg(*) as *]

The limit=0 will make your OTHER go away, be wary of huge host counts though. The appendpipe will add a row to the bottom with your averages per span.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Assuming you just want a daily average, you can do this:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | stats sum(GB) as total by series | addinfo | eval days = (info_max_time - info_min_time) / 86400 | fields - info* | eval daily_average = total / days

That's throwing out your timechart entirely. If you somehow want the daily average appended to your timechart you can do this:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1d limit=0 | appendpipe [stats avg(*) as *]

The limit=0 will make your OTHER go away, be wary of huge host counts though. The appendpipe will add a row to the bottom with your averages per span.

jodros
Builder

Thanks! You the man!

0 Karma

jodros
Builder

The search that I am using is:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1d

This search run across seven days produces seven points of data for each host. What I would like to do is produce 1 point of data that would be the average of the 7 days, or 30 days, or whatever timeframe the search was ran.

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...