topic Re: How to stats count by app name , and avg count per minute by app name together in one query in Splunk Search

How to stats count by app name , and avg count per minute by app name together in one query

sivaranjani — Sat, 15 Jun 2024 08:12:05 GMT

Re: How to stats count by app name , and avg count per minute by app name together in one query

yuanliu — Sat, 15 Jun 2024 07:04:43 GMT

This is not a question, is it? Here are some basics of asking an answerable question.

Illustrate data in text format (anonymize as needed) - be it raw events, extracted fields, or output from a preceding search. Illustrate or explain any characteristics that is perhaps helping or preventing you from reaching desired results.
Illustrate desired output (in text format unless the question is about visualization) corresponding to illustrated data.
Explain the logical connection between illustrated data and desired output, all without SPL.
If you already tried some SPL, also illustrate actual output from that illustrated data, then explain how actual output differs from desired output if that is not painfully obvious.

Re: How to stats count by app name , and avg count per minute by app name together in one query

gcusello — Sat, 15 Jun 2024 09:52:26 GMT

Hi @sivaranjani ,

let me understand:

you want to calculate the average per minute in a period and then display the count and the average per minute for each app, is it correct?

if this is your requirement, please, try something like this:

index=abc cf_space_name=prod-ad0000123 cf_app_name IN (RED,Blue,Green) "Initiating " OR "Protobuf message received" OR "Event Qualification Determined" | bucket _time span=1m | stats count(eval(cf_app_name == "RED)) AS RedVolume_by_min count(eval(cf_app_name == "blue")) AS BlueVolume_by_min count(eval(cf_app_name == "Green")) AS GreenVolume_by_min avg(GreenVolume) as AvgGVolume BY _time | stats sum(RedVolume_by_min) AS RedVolume sum(BlueVolume_by_min) AS BlueVolume sum(GreenVolume_by_min) AS GreenVolume avg(RedVolume_by_min) AS RedVolume_avg avg(BlueVolume_by_min) AS BlueVolume_avg avg(BlueVolume_by_min) AS BlueVolume_avg BY _time | eval estimate = (RED + Blue - Green) / AvgGVolume

Ciao.

Giuseppe

Re: How to stats count by app name , and avg count per minute by app name together in one query

sivaranjani — Sat, 15 Jun 2024 17:52:22 GMT

Thanks this is perfect. Exactly what i needed.

Re: How to stats count by app name , and avg count per minute by app name together in one query

gcusello — Sun, 16 Jun 2024 13:56:50 GMT

Hi @sivaranjani ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉