Hi,
I have a query that looks like this
index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration|rename duration as "Login Duration in Seconds" statscount as "Number of times the Login Duration Occurred"| appendpipe [stats count | where count=0]
It makes a table that shows this
What I'd like to to is get an average number of seconds for login duration but using both columns. Example
1 second occurred 16 times so 1 second would have to be counted 16 times in the average.
Thoughts?
Give this a try
index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration| appendpipe [stats count | where count=0]
| eval noofsecs=statscount*duration | stats sum(noofsecs) as noofsecs sum(statscount) as totaloccurances | eval "Average number of secs per login"=round(noofsecs/totaloccurances,2)
Give this a try
index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration| appendpipe [stats count | where count=0]
| eval noofsecs=statscount*duration | stats sum(noofsecs) as noofsecs sum(statscount) as totaloccurances | eval "Average number of secs per login"=round(noofsecs/totaloccurances,2)
Hey Somesoni2!
Very nice solution! Thank you! (Again)