topic Re: timechart by count, average(timetaken) by type in Splunk Search

timechart by count, average(timetaken) by type

dukechandu — Tue, 06 Sep 2016 15:32:15 GMT

Hi,

i have data like below

Type count timeTakenToexceute time
abc 2 2 sec 09-01-2016, 09-02-2016
xyz 1 1 sec 09-01-2016

needed timechart based on day, i am trying like below but missing count
..... | timechart span=1d avg(timetaken) by type

please help

thanks in advance.

Re: timechart by count, average(timetaken) by type

sundareshr — Tue, 06 Sep 2016 16:50:08 GMT

Try this

... | bin span=1d _time | stats avg(timetaken) as average count by _time typ

Re: timechart by count, average(timetaken) by type

somesoni2 — Tue, 06 Sep 2016 16:57:32 GMT

Try like this. It will create fields like AvgTime :Type and Count :Type. E.g. AvgTime :abc, Count: xyz

..... | timechart span=1d avg(timetaken) as AvgTime count as Count by type

Re: timechart by count, average(timetaken) by type

dukechandu — Tue, 06 Sep 2016 18:02:29 GMT

Thank you for your answers, but the issue i am facing here for count its showing separate bar, but i need both average and count displaying in single bar, is it possible.

please find the below image, first two bars shows average time taken and second two bars shows count of each type, i want there four bars in two bars displaying average and count.

thanks in advance

Re: timechart by count, average(timetaken) by type

sundareshr — Tue, 06 Sep 2016 18:43:59 GMT

Have you tried stacked chart?

https://docs.splunk.com/Splexicon:Stackmode

OR, overlay may be a better option

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/Chartcontrols#Chart_overlay_example_.28single_axis.29

Re: timechart by count, average(timetaken) by type

somesoni2 — Tue, 06 Sep 2016 18:57:59 GMT

Both Average and count fields are different entity and can possibly have different magnitude in the y-axis. Why do you want to merge both? do you want to merge both average and count for each type? If yes, then just remove by type in the above query.