https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47793#M11406 <P>Fellow Splunkers, I have a chart that displays my Apache processing times as such</P> <PRE><CODE>Seconds count 0 191952 1 3494 2 408 3- 5 3429 5- 10 277 10- 20 294 20- 60 95 60-120 13 120-300 23 300-600 3 </CODE></PRE> <P>The search command is a simple <BR /></P> <PRE><CODE>index="log_index" | eval LatencyRanges=case(seconds=0, "0 sec", seconds=1, "1 sec", etc., etc.) | stats count by LatencyRanges </CODE></PRE> <P>What can I use after this to display the Average Second for the Total count as my last field? <BR /> Any feedback is greatly appreciated. Thanks.</P> Thu, 28 Feb 2013 22:41:01 GMT ten_yard_fight 2013-02-28T22:41:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47793#M11406 <P>Fellow Splunkers, I have a chart that displays my Apache processing times as such</P> <PRE><CODE>Seconds count 0 191952 1 3494 2 408 3- 5 3429 5- 10 277 10- 20 294 20- 60 95 60-120 13 120-300 23 300-600 3 </CODE></PRE> <P>The search command is a simple <BR /></P> <PRE><CODE>index="log_index" | eval LatencyRanges=case(seconds=0, "0 sec", seconds=1, "1 sec", etc., etc.) | stats count by LatencyRanges </CODE></PRE> <P>What can I use after this to display the Average Second for the Total count as my last field? <BR /> Any feedback is greatly appreciated. Thanks.</P> Thu, 28 Feb 2013 22:41:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47793#M11406 ten_yard_fight 2013-02-28T22:41:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47794#M11407 <PRE><CODE>... | eventstats avg(count) as avg_count </CODE></PRE> Fri, 01 Mar 2013 00:04:08 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47794#M11407 jonuwz 2013-03-01T00:04:08Z https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47795#M11408 <P>Thanks for replying. I finally got around to playing with this one. I tweaked it a little but I got the concept.</P> Thu, 07 Mar 2013 00:56:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47795#M11408 ten_yard_fight 2013-03-07T00:56:27Z https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47796#M11409 <P>for anyone interested in using a search similar to mine for getting avg response time.</P> <PRE><CODE>...| eval seconds=spent*1.0e-6 | eventstats avg(seconds) AS Avg_Response_time_in_sec | eval Avg_Response_time_in_sec=round(Avg_Response_time_in_sec, 0) | chart count AS #Requests by Avg_Response_time_in_sec </CODE></PRE> <P>So it take processing time in microseconds and converts to seconds, does an average of the total count of seconds and puts into the Avg_Response_time_in_sec field, then charts it out...</P> Mon, 28 Sep 2020 13:27:40 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-display-the-average-processing-time-after-the-total/m-p/47796#M11409 ten_yard_fight 2020-09-28T13:27:40Z