Splunk Search

How to find an Average Count over an hour in 5 min buckets

luckyman80
Path Finder

Hi Experts!
So I have an issue with GC cycles and we have this logged in splunk. I have used the below query which gives me the minor occurrences count overall (and works fine )

sourcetype=system*process*gc* "[GC pause" | rex field=source "print.prod..?(?.?)\/" | rex field=source "system_print(?.*?)_" | timechart span=5m limit=0 count(_raw) by instance

There are some parts of the day when some processes have large minor occurrences count and other times not so much. Im trying to find out and average count over and hour in 5 min buckets to see any large uptrends in count in general.

Any advice etc would be amazing.

Paul

0 Karma

luckyman80
Path Finder

Thanks Guys.. both of these work a treat!

0 Karma

dmarling
Builder

This will accomplish a average of the 5 minute bucket counts over whatever time frame you run it, but it won't include the zeros that get added by the timechart process into your average.

sourcetype=system*process*gc* "[GC pause" 
| rex field=source "print.prod..?(?.?)\/" 
| rex field=source "system_print(?.*?)_" 
| bin span=5m _time
| stats count by _time instance
| stats avg(count) as Average by instance

If you require those zeros provided by the timechart this will use that, but it will only work for a 60 minute time range of the search:

sourcetype=system*process*gc* "[GC pause" 
| rex field=source "print.prod..?(?.?)\/" 
| rex field=source "system_print(?.*?)_" 
| timechart span=5m limit=0 count(_raw) by instance partial=f
| transpose 0 column_name="instance" header_field=_time 
| addtotals
| eval Average=round(Total/11,6)
If this comment/answer was helpful, please up vote it. Thank you.

somesoni2
SplunkTrust
SplunkTrust

Just add following to the end of your current search.

current search with timechart span=5m...
| timechart span=1h avg(*) as *

dmarling
Builder

Your solution is way simplier! I like it.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...