topic Re: stats for a given time range for last 30 days in Splunk Search

stats for a given time range for last 30 days

adoshi — Mon, 28 Sep 2020 12:02:35 GMT

I would like to get an average of a any given value for a time range say 7:00 PM to 8:00 PM over last 30 days.

Would I need to use sum(eval(if(_Time >= StartTime,if (_time<=EndTime,ValueToSum,0),0) and then calculate the average?

Re: stats for a given time range for last 30 days

ak — Mon, 28 Sep 2020 12:02:40 GMT

that's one of doing it.

I would suggest building it as follows:

specify fields earliest,latest to narrow the range
use the where command to limit the start/end times of each day, further narrowing your dataset
apply the stats command across that range

for example

earliest=-31d latest=-1d | where strftime(_time, "%H") > "18" AND strftime(_time, "%H") < "21" | stats count(FIELD) over _time

Re: stats for a given time range for last 30 days

adoshi — Mon, 09 Jul 2012 21:19:32 GMT

Thank you. I am planning to use this in a monitoring scenario so if error counts in last 30 minutes increase more than the 30 day average (during the same 30 minutes) then we have a problem. So would you recommend sticking to rounded 30 minutes or do last 30 minutes?