Splunk Search

Average of session duration

keshab
Path Finder

search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID

I got the each session duration using the above command. Now how do I calculate the average of all those session duration??

Tags (1)

hjwang
Contributor

if you only wanna show final result , just

SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duraion_sec)

else if you wanna append to first result

SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | append [ search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duraion_sec)]

Here I think the Splunk should expand some calculating functions to add rows like addcoltotals to summarize the table results. If some of this have been existed, please let me know. Thanks!!

0 Karma

kristian_kolb
Ultra Champion

just pipe it through stats again

| stats avg(Session_Duration_Sec)

/kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...