Turns stats into timechart with avg

Silah — Tue, 18 Jun 2024 14:03:58 GMT

I asked in a previous thread for help to get response time based on time differential between two events connected by a UUID (Solved: Re: Measuring time difference between 2 entries - Splunk Community) which is working perfectly.

I turned that into an average response time grouped by a particular transaction type (processName) and thats working fine as well, but I would very much like to use this as a timechart - but I can't seem to get it working.

From what I understand, the fact that I am using Stats stripts out the _time which the timechart uses, but I am not sure how to work around that.

My query goes as follows:

[My search here] | stats earliest(eval(if(eventType="BEGIN",_time,""))) AS Begin_time latest(eval(if(eventType="END",_time,""))) AS End_time BY UUID processName | eval ResponseTime=End_time-Begin_time | stats avg(ResponseTime) by processName

I've tried a number of things that didn't work, including changing stats to:

| timechart span=10m Avg(ResponseTime) by processName

While this did perform a search, it generated no result whatsoever. Won't bore everyone with my multiple failures.

My query gives me basically

ProcessName	Avg(Response_time)
Process1	0.5
Process2	0.6
Process3	0.7

My goal is to get this as a time chart visualization with a span of 10 mins.

Any suggestions ?

Thanks

Re: Turns stats into timechart with avg

glc_slash_it — Tue, 18 Jun 2024 14:11:39 GMT

That is because timechart command requires to have the _time field, and you are removing it with the first stats command.

Try this:

Re: Turns stats into timechart with avg

Silah — Tue, 18 Jun 2024 14:14:33 GMT

Beautiful. Thank you, this worked and now I understand how to pass the time in when it gets stripped out earlier.

topic Turns stats into timechart with avg in Splunk Search

Turns stats into timechart with avg

Re: Turns stats into timechart with avg

Re: Turns stats into timechart with avg