https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58144#M14205 <P>The <CODE>transaction</CODE> command produces two fields, <CODE>duration</CODE> and <CODE>eventcount</CODE>. You could use <CODE>eventcount</CODE> in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:</P> <PRE><CODE>eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount) </CODE></PRE> Sat, 12 Mar 2011 17:20:10 GMT Ayn 2011-03-12T17:20:10Z https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58143#M14204 <P>I would use the example on <A href="http://www.splunk.com/base/Documentation/latest/AppManagement/Summarizeeventsovertimeusingtimechart" rel="nofollow">this page</A> as the base for my question:</P> <PRE><CODE>eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration) </CODE></PRE> <P>Averages are great ... but if there is a spike i would like to know the size of the sample the average was taken over.</P> <P>So i would like to add to this timechart also the count of the number of transactions in that timeframe.</P> <P>Anyone know if this is possible ?</P> Sat, 12 Mar 2011 16:48:10 GMT https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58143#M14204 bowa 2011-03-12T16:48:10Z https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58144#M14205 <P>The <CODE>transaction</CODE> command produces two fields, <CODE>duration</CODE> and <CODE>eventcount</CODE>. You could use <CODE>eventcount</CODE> in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:</P> <PRE><CODE>eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount) </CODE></PRE> Sat, 12 Mar 2011 17:20:10 GMT https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58144#M14205 Ayn 2011-03-12T17:20:10Z https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58145#M14206 <P>Thanks a lot ! exactly what i needed</P> Sat, 12 Mar 2011 18:09:54 GMT https://community.splunk.com/t5/Splunk-Search/timechart-avg-vs-count/m-p/58145#M14206 bowa 2011-03-12T18:09:54Z