Splunk Search

How i get Avg, Max, Min for every 5 min interval one by one in row?

nitesh218ss
Communicator

I create query which give total Average, min and max value in one row i need the result come in every 5 minuet Avg, Max, Min in one by one in row Like
Time_diff AVg Max Min
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:10:00.00 - 07:14:59.999 1.7 1.9 1.4

My Query is
<code start>
index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ] |eventstats latest(time1) as lat,earliest(time2) as ear| eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 |stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min

<code end>
Please help in this problem

Tags (3)
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

If I understood you correctly, you want to use bucket on Time_diff (docs here).

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

If I understood you correctly, you want to use bucket on Time_diff (docs here).

0 Karma

nitesh218ss
Communicator

....|bucket _time span=5m I use this in many place but not effect
any small example .which i understand and learn easly

0 Karma

jeffland
SplunkTrust
SplunkTrust

Using it on _time won't help you if you are looking to bucket TimeDiff in five minute spans. You should probably go with something like

| bucket TimeDiff span=5m
0 Karma

nitesh218ss
Communicator

Thankyou very much

0 Karma

nitesh218ss
Communicator

hi i got Thanku very much for help me
my query is:

index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ] | eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 | bucket _time span=5m |stats avg(TimeDiff) min(TimeDiff),max(TimeDiff) by _time

this quey working for every 5 min
but only one problem is date are not present in log file so splunk take auto date so the output is change base on date differ

0 Karma

nitesh218ss
Communicator

i use this also but they given 0 output because.
TimeDiff is only difference between request time and response time of transaction in other word TimeDiff is difference between sub query and main query but i want base on main time that is time1 or time2
It is possible by bucket
i try bucket time1 span=5m, bucket time2 span=5m but not any effect i got only one row
not different row of every 5 min

0 Karma

jeffland
SplunkTrust
SplunkTrust

Using bucket on the initial time will not help you at all, you need to do that on the data of the resulting table (because you want the resulting table to be grouped by five minute intervals). Have you tried adding by TimeDiff at the end of your stats?

0 Karma

nitesh218ss
Communicator

I try but they give base on every Average of Time_diff for particular Time_diff
but TimeDiff is only time1-time2
time1 and time2 is important
TimeDiff is time take per trancation that is only in some milisecond to second
I need every 5 min of time1 they calculate Avg of TimeDiff

TimePer5_min AVg(Time_diff) Max(Time_diff) Min(Time_diff)
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:10:00.00 - 07:14:59.999 1.7 1.9 1.4

I try from 1 and half day but i not got solution

0 Karma

jeffland
SplunkTrust
SplunkTrust

You need to bucket before your stats.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...