topic Counting averages in Splunk Search

Counting averages

jamesklassen — Wed, 15 Dec 2010 03:14:52 GMT

I have data for users running in two modes: Online, and Cached.

I want to get the average number of connections for each type of user over a 1 week period, so that I have a line graph and compare the load on the server for each type of user.

How can I do this? I think I'm way off track...

index=sanindex source="rpc" | timechart span=1h count(client_name)

client_mode is either Online or Cached. client_name is the name of a connecting user.

Thank you

James

Hi, James: Let me add more information about what you're looking for

Log Events

   The logs contains
    - client_mode: Classic, Cached, etc...
    - client_name: 100s of different values 

   Each client_name is with either "client_mode=Classic" or "client_mode=Cached"

What to achieve
1. Count of each client_user every hour in the past one week
2. Average the count of all the client_user per hour in the past one week
3. Compare the averaged user's client_mode, Classic and Cached, in order to see one "average" user's mode.

Re: Counting averages

gkanapathy — Wed, 15 Dec 2010 05:47:52 GMT

index=sanindex source="rpc" client_name=* | timechart span=1h count by client_mode

Re: Counting averages

jamesklassen — Mon, 28 Sep 2020 09:22:08 GMT

Thanks gkanpathy, but not quite.

I'd like to compare the average number of connections of each type, per day. So I take the average count of entries per day for client_mode=Cached, and the average count of entires per day where client_mode=Online, and then I can compare the two in a line graph.

Thank you for your help.

Re: Counting averages

Masa — Thu, 16 Dec 2010 06:57:53 GMT


index=sanindex source="rpc" client_mode=Classic OR client_mode=cached earliest=-30d@d latest=@d 
  | bucket _time span=1h 
  | stats count by _time, client_name, client_mode 
  | timechart avg(count) by client_mode