Splunk Search

How to aggregate data in an index

philipfritsch
New Member

Right now we receive and store several data points per second in an index and do reporting on it.
In the future we would like to aggregate this data by calculating the average value of all data points (integer values) per minute and store it in a seperate index,
How do you do this?

0 Karma

chris1337
Explorer

Hi,

you could try:

index=source_index | timechart span=1minute avg(your_integer_field) AS your_integer_field |  collect index=destination_index

Check out the collect command:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Collect

Greetings Chris

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...