Dear experts,
I apologize but I am new on Splunk and I have a question which can be really simple for you ...
I have just uploaded a file Inside Splunk for SAP jobs analyzing. The format is really simple :
JobName | StartDate | Duration
I have retrieved the jobs with the highest execution duration by the search -> stats count(JobName) avg(Duration_sec) by JobName
However, I want to add the following condition "Only the JobName with more than 100 exécutions should be counted".
How can I modify my query ?
Thanks really in advance.
Regards.
Stéphane
Perhaps this is what you are looking for.
stats count(JobName) as Executions avg(Duration_sec) by JobName | where Executions > 100
Thanks really for all, both solutions work perfectly. The second one is perhaps simplest ...
Perhaps this is what you are looking for.
stats count(JobName) as Executions avg(Duration_sec) by JobName | where Executions > 100
Hi
1st scenario: gives you the jobs that were executed more than 100 times
| stats count(JobName) AS COUNTER avg(Duration_sec) AS AVG_DURATION by JobName | where COUNTER>100 | table JobName, AVG_DURATION
2nd scenario: if you want to calculate the avg_duration of jobs that were executed more than 100 times, you can do this:
| eventstats count(JobName) AS COUNTER by JobName | where COUNTER>100 | stats avg(Duration) as AVG_DURATION by JobName | table JobName, AVG_DURATION
That returns only the