How to create a timechart with min, max, average and count values?

shasha97 — Tue, 19 Mar 2024 18:39:35 GMT

I have written this query:

index=index_name (log.event=res OR (log.event=tracing AND log.operationName=query_name)) | timechart span=1m avg(log.responseTime) as AvgTimeTaken, min(log.responseTime) as MinTimeTaken, max(log.responseTime) as MaxTimeTaken count by log.operationName

My results look like this:

_time	AvgTimeTaken: NULL	MaxTimeTaken: NULL	MinTimeTaken: NULL	count:query_name	count: NULL	count:query_name
2024-03-18 13:00:00				0	0	0

I want to understand what the :NULL means, and also how I can get the query to display all values. Secondly, the count is getting displayed for query_name that is similar to the query_name in my query string. I wanted to get an exact match on the query_name. Can someone please help me with this?

Thanks!

Re: How to create a timechart with min, max, average and count values?

PickleRick — Tue, 19 Mar 2024 21:43:01 GMT

If you specify multiple aggregation functions for timechart by some field, it creates separate data series for each aggregation function and the field value. In the case of :NULL these are stats for events where the field value is empty (I suspect that for log.event=res there is no field log.operation).

topic How to create a timechart with min, max, average and count values? in Splunk Search

How to create a timechart with min, max, average and count values?

Re: How to create a timechart with min, max, average and count values?