Splunk Search

Average count of events per field grouped by another field

rmm1982
New Member
Hello All,
I'm a relative newbie and hoping the community can help me out. I'm kind of stuck on a query and I can't figure out how to get the correct results.
 
I have an event that has a referer and a txn_id. Multiple events with the same referer field can have the same txn_id.
 
 
RefererTxn_idresponse_time
googleabcd123442
googleabcd123443
googleabcd123444
google1234abcd45
google1234abcd46
google1234abcd47
google1234abcd48
yahooxyz123110
yahoo123xyx 120
yahoo123xyz130
 
What I am trying to do is get the average number of txn_ids per referer and the avg of response times for that. So something like this:
 
 
Refereravg(count txn_id)avg(response_time)
google3.544.5
yahoo1.5120
 
Any help would be appreciated.
Thanks!
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| stats dc(Txn_id) as unique_tx_ids count avg(response_time) as average by Referer
| eval average_count_txns_id=count/unique_tx_ids
0 Karma

rmm1982
New Member

Thanks! That seemed to do it

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...