topic Re: calculate average of last 30 days in Splunk Search

calculate average of last 30 days

thomaap — Wed, 05 Feb 2020 13:14:40 GMT

below average function is not giving me the correct value for last 30 days.Kindly advise

| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTime

Re: calculate average of last 30 days

richgalloway — Wed, 05 Feb 2020 13:51:02 GMT

I see no attempt to calculate an average in that SPL. What field do you want to average?

Re: calculate average of last 30 days

thomaap — Wed, 05 Feb 2020 14:21:02 GMT

Re: calculate average of last 30 days

richgalloway — Wed, 05 Feb 2020 15:20:19 GMT

The streamstats avg(diff) as average window=30 command will calculate the average diff over the previous 30 events, not necessarily 30 days. Try this, instead:

<compute diff>
| bucket span=30d _time
| stats avg(diff) as average by _time
| eval avrg = round(average, 2)

Re: calculate average of last 30 days

thomaap — Wed, 30 Sep 2020 04:07:56 GMT

i tried updating to be above code.however it does not seem to give me the correct value .The existing values are not returning after the change .

index=MY_INDEX JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTime

Re: calculate average of last 30 days

richgalloway — Thu, 06 Feb 2020 15:53:09 GMT

That's the nature of stats, which seemed fine since your question asked about calculating average and said nothing about preserving other values.