Splunk Search

stats for a given time range for last 30 days

adoshi
Explorer

I would like to get an average of a any given value for a time range say 7:00 PM to 8:00 PM over last 30 days.

Would I need to use sum(eval(if(_Time >= StartTime,if (_time<=EndTime,ValueToSum,0),0) and then calculate the average?

Tags (2)
0 Karma

ak
Path Finder

that's one of doing it.

I would suggest building it as follows:

  1. specify fields earliest,latest to narrow the range
  2. use the where command to limit the start/end times of each day, further narrowing your dataset
  3. apply the stats command across that range

for example


earliest=-31d latest=-1d | where strftime(_time, "%H") > "18" AND strftime(_time, "%H") < "21" | stats count(FIELD) over _time

adoshi
Explorer

Thank you. I am planning to use this in a monitoring scenario so if error counts in last 30 minutes increase more than the 30 day average (during the same 30 minutes) then we have a problem. So would you recommend sticking to rounded 30 minutes or do last 30 minutes?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...