How to find an Average Count over an hour in 5 min buckets

[luckyman80]

Hi Experts!
So I have an issue with GC cycles and we have this logged in splunk. I have used the below query which gives me the minor occurrences count overall (and works fine )

sourcetype=system*process*gc* "[GC pause" | rex field=source "print.prod..?(?.?)\/" | rex field=source "system_print(?.*?)_" | timechart span=5m limit=0 count(_raw) by instance

There are some parts of the day when some processes have large minor occurrences count and other times not so much. Im trying to find out and average count over and hour in 5 min buckets to see any large uptrends in count in general.

Any advice etc would be amazing.

Paul

[luckyman80]

Thanks Guys.. both of these work a treat!

[dmarling]

This will accomplish a average of the 5 minute bucket counts over whatever time frame you run it, but it won't include the zeros that get added by the timechart process into your average.

sourcetype=system*process*gc* "[GC pause" 
| rex field=source "print.prod..?(?.?)\/" 
| rex field=source "system_print(?.*?)_" 
| bin span=5m _time
| stats count by _time instance
| stats avg(count) as Average by instance

If you require those zeros provided by the timechart this will use that, but it will only work for a 60 minute time range of the search:

sourcetype=system*process*gc* "[GC pause" 
| rex field=source "print.prod..?(?.?)\/" 
| rex field=source "system_print(?.*?)_" 
| timechart span=5m limit=0 count(_raw) by instance partial=f
| transpose 0 column_name="instance" header_field=_time 
| addtotals
| eval Average=round(Total/11,6)

[somesoni2]

Just add following to the end of your current search.

current search with timechart span=5m...
| timechart span=1h avg(*) as *

[dmarling]

Your solution is way simplier! I like it.