https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614530#M213581 <P>I have a need to compare the average time for certain events with the 5 min bucket/bins of the same events. The idea is to find 5 min intervals that deviate more than a certain percentage from the average response times and then in some way display those intervals.</P> <P>I am however struggling to figure out how to output the Average for the entire time period but also calculate the 5 minute intervals.</P> <P>The following query, returns nothing (can you even do 2 Stats in the same query?):</P> <P>search | stats avg(Value) as AvgEntirePeriod | bin _time span=5m | stats avg(Value) by _time</P> <P>Any ideas on how to write this?</P> Mon, 26 Sep 2022 15:38:38 GMT dmoberg 2022-09-26T15:38:38Z https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614530#M213581 <P>I have a need to compare the average time for certain events with the 5 min bucket/bins of the same events. The idea is to find 5 min intervals that deviate more than a certain percentage from the average response times and then in some way display those intervals.</P> <P>I am however struggling to figure out how to output the Average for the entire time period but also calculate the 5 minute intervals.</P> <P>The following query, returns nothing (can you even do 2 Stats in the same query?):</P> <P>search | stats avg(Value) as AvgEntirePeriod | bin _time span=5m | stats avg(Value) by _time</P> <P>Any ideas on how to write this?</P> Mon, 26 Sep 2022 15:38:38 GMT https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614530#M213581 dmoberg 2022-09-26T15:38:38Z https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614542#M213582 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/248238">@dmoberg</a>,</P><P>you can use eventstats to have the average of the full period, something like this:</P><LI-CODE lang="markup">search | eventstats avg(Value) as AvgEntirePeriod | bin _time span=5m | stats avg(Value) AS AvgFiveMinutes values(AvgEntirePeriod) AS AvgEntirePeriod BY _time | eval perc=round(AvgFiveMinutes/AvgEntirePeriod*100,2)</LI-CODE><P>Ciao.</P><P>giuseppe</P> Mon, 26 Sep 2022 11:51:50 GMT https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614542#M213582 gcusello 2022-09-26T11:51:50Z https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614543#M213583 <P>You can do as many stats calls as you like in a query, but what you need is eventstats. Also timechart can be used to replace the bin and stats.<BR /><BR /><SPAN>search | timechart span=5m avg(Value) as binAvg | eventstats avg(binAvg) as allAvg<BR /></SPAN></P> Mon, 26 Sep 2022 11:54:23 GMT https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614543#M213583 andrew_nelson 2022-09-26T11:54:23Z https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614684#M213628 <P>Thanks! The EventStats did the trick</P> Tue, 27 Sep 2022 07:28:17 GMT https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614684#M213628 dmoberg 2022-09-27T07:28:17Z https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614688#M213630 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/248238">@dmoberg</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated by all the contributors <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 27 Sep 2022 07:40:15 GMT https://community.splunk.com/t5/Splunk-Search/Stats-with-different-bins-full-time-period-AND-5-min-intervals/m-p/614688#M213630 gcusello 2022-09-27T07:40:15Z