topic Re: Graph hourly events multiplied by avgevent duration (in hours), in Dashboards & Visualizations

Graph hourly events multiplied by avgevent duration (in hours),

c799651 — Wed, 30 Sep 2020 04:52:25 GMT

Hi I have data with captures events (phone calls). I would like to graph in hourly buckets the total calls per hour multiplied by the avg call duration.

I have fumbled around and been able to present the two components in separate charts but failed when trying to merge both charts into one with the multiplication performed.

First Search

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H")
| stats count AS B_Number first(date_hour) AS date_hour BY _time
| stats avg(B_Number) BY date_hour

Second Search.

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H") | eval Callhours=CallDurationSecs/3600
| stats avg(Callhours) BY date_hour

How do I combine these searches with the muliplication applied.
Eg Search 1 Hour 1 result equals .00112299
Search 1 Hour 1 result equals 35555
Desired result for hour 1 399.21 (.00112299*35555)

Re: Graph hourly events multiplied by avgevent duration (in hours),

to4kawa — Sun, 05 Apr 2020 01:18:07 GMT

index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

Re: Graph hourly events multiplied by avgevent duration (in hours),

c799651 — Sun, 05 Apr 2020 02:26:29 GMT

Thanks very much this worked. But when I used "visualisation" Splunk is graphing A, B and result by hour.
How do I just show result by Hour in the column chart?

Thanks Again

Re: Graph hourly events multiplied by avgevent duration (in hours),

c799651 — Sun, 05 Apr 2020 03:16:36 GMT

think I worked it out. Just added

| stats avg(result) by date_hour