Summarize data on xyseries chart

indeed_2000 — Wed, 16 Jun 2021 05:23:27 GMT

I have spl command like this:

| rex "duration\[(?<duration>\d+)\].*?method:\s(?<method>[^\s]+)" | xyseries _time method duration

it will produce lots of point on chart, how can I reduce number of points on chart?

for example in 1 minute over 100 “duration” points exist , I want to create 1 point each minutes and show average of that 100 point on single point per minute.

any idea?

Thanks

Re: Summarize data on xyseries chart

ITWhisperer — Wed, 16 Jun 2021 05:45:44 GMT

| rex "duration\[(?<duration>\d+)\].*?method:\s(?<method>[^\s]+)" | timechart span=1m avg(duration) as averageDuration by method

topic Summarize data on xyseries chart in Splunk Search

Summarize data on xyseries chart

Re: Summarize data on xyseries chart