Splunk Search

How write a search to place averages from different time ranges on the same column chart?

Bliide
Path Finder

I am trying to place values with different time ranges on the same column chart. I have 3 values that I would like to place on the same chart for comparison. I would like the last value, the 24 hour average and the 7 day average of that value on the same chart. I cannot find how to configure the search to create the values. Is this something that I need to use an eval for?

Tags (4)
0 Karma

stephanefotso
Motivator

Hello! My proposition is not optimal, but it can help you as a start point. Let suppose you are working with the _internal index and you want the last sourcetype, the 24 hour average and the 7 day average of that value on the same chart. Here you go!

index=_internal sourcetype=*|stats first(sourcetype) count as countvalue|join [search index=_internal sourcetype=*|bucket  _time span=1d|stats count as total24h by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg24h=countfirst/total24h|table avg24h]|join[search index=_internal sourcetype=*|bucket  _time span=7d|stats count as total7day by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg7day=countfirst/total7day|table avg7day]|table countvalue avg24h avg7day

dmaslin_splunk's link can help you uptimise that query,

SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...