topic Re: Use TimePicker to average on a specific field in Splunk Search

Use TimePicker to average on a specific field

pwilly — Wed, 18 Jan 2017 19:53:06 GMT

I have a dashboard with several inputs to include a timepicker, one of my panels charts the sums of specific fields over the time picked. I would like to add another column that acts upon one of those sums and get the avg per minute.

For example time picked is 4 hours
Column 1 = 480

The new column would then need to take that result and divide it by the number of minutes specified in the time picker
480/240minutes = 2 per minute

Re: Use TimePicker to average on a specific field

rjthibod — Wed, 18 Jan 2017 20:24:18 GMT

The community can best help you if you share part or whole of your search query. That way we can more efficiently help by targeting the specific fields and commands you are using.

Re: Use TimePicker to average on a specific field

pwilly — Tue, 29 Sep 2020 12:29:49 GMT

My search looks like the following
index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput

I would like an additional column that per NAME looks at the sum of MSG_1_COUNT for that NAME and divides it by the number of minutes that will be specified in the timepicker input so I can get average MSG_1_COUNT per Minute
Thanks

Re: Use TimePicker to average on a specific field

somesoni2 — Wed, 18 Jan 2017 20:44:24 GMT

Try this. The eval on 2nd last line will add a field called Minutes, containing number of minutes in the selected timerange. You can use that for your 'per min' calculation.

index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput 
| eval Minutes=[| gentimes start=-1 | addinfo | eval search=round((info_max_time-info_min_time)/60) | table search] 
| eval MSG_1_COUNT_PerMin=MSG_1_COUNT/Minutes | fields - Minutes

Re: Use TimePicker to average on a specific field

DalJeanis — Wed, 18 Jan 2017 20:45:48 GMT

It's going to look something like

| eval PerMinute = 60*MSG_1_COUNT / ($timerange.latest$ - $timerange.earliest$)

Re: Use TimePicker to average on a specific field

DalJeanis — Wed, 18 Jan 2017 20:54:18 GMT

cute. I hadn't thought of using addinfo instead of pulling it off the interface.