Splunk Search

Getting averages from 2 columns

dbcase
Motivator

Hi,

I have a query that looks like this

index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration|rename duration as "Login Duration in Seconds" statscount as "Number of times the Login Duration Occurred"| appendpipe [stats count | where count=0]

It makes a table that shows this

alt text

What I'd like to to is get an average number of seconds for login duration but using both columns. Example

1 second occurred 16 times so 1 second would have to be counted 16 times in the average.

Thoughts?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

 index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration| appendpipe [stats count | where count=0]
| eval noofsecs=statscount*duration | stats sum(noofsecs) as noofsecs sum(statscount) as totaloccurances | eval "Average number of secs per login"=round(noofsecs/totaloccurances,2)

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

 index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration| appendpipe [stats count | where count=0]
| eval noofsecs=statscount*duration | stats sum(noofsecs) as noofsecs sum(statscount) as totaloccurances | eval "Average number of secs per login"=round(noofsecs/totaloccurances,2)
0 Karma

dbcase
Motivator

Hey Somesoni2!

Very nice solution! Thank you! (Again)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...