topic How to create graph based on Std deviation & Avg in Splunk Search

How to create graph based on Std deviation & Avg

jaibalaraman — Tue, 02 Apr 2024 02:43:41 GMT

Can anyoine suggest me how to create Avg & Std Dev graph from the fields

KendallW — Tue, 02 Apr 2024 03:05:42 GMT

. . . | timechart avg(event.Properties.duration) stdev(event.Properties.duration)

tscroggins — Tue, 02 Apr 2024 03:08:39 GMT

You can calculate the mean and standard deviation using the stats command:

| stats avg(event.Properties.duration) as u stdev(event.Properties.duration) as s

however, that won't produce a chart.

At a glance, your data is not normally distributed. You can generate a simple histogram with the chart command:

| chart count over event.Properties.duration span=31

If you have Splunk Machine Learning Toolkit installed, you can use the histogram macro and visualization:

| `histogram("event.Properties.duration", 31)`

Note that the histogram macro uses the bin command:

bin "$var$" bins=$bins$ | stats count by "$var$" | makecontinuous "$var$" | fillnull count

It won't necessarily honor your bin count.

What type of graph or visualization would you like to create?

jaibalaraman — Tue, 02 Apr 2024 03:11:15 GMT

Hi Kendall

yes i tried that, stil not getting any output

KendallW — Tue, 02 Apr 2024 04:20:49 GMT

Add a space between the two timechart functions. E.g.

| timechart avg(event.Properties.duration) stdev(event.Properties.duration)

Also, you can remove the

| iplocation

as we aren't using any of the fields that command adds for this visualization, so it will only slow down the search.

jaibalaraman — Tue, 02 Apr 2024 08:12:15 GMT

The below 2 commands are not working

| `histogram("event.Properties.duration", 31)`

bin "$var$" bins=$bins$ | stats count by "$var$" | makecontinuous "$var$" | fillnull count

What type of graph or visualization would you like to create?

Just want to create a dashboard tile to show the metric