topic Re: How to add an average transaction duration overlay to a timechart with a split by clause? in Splunk Search

How to add an average transaction duration overlay to a timechart with a split by clause?

bradj013 — Thu, 30 Oct 2014 19:43:21 GMT

Splunk=6.1.4

My search looks like this:
| transaction TransID keepevicted=true | search eventcount=2 | timechart limit=0 span=1m max(duration) by host

Trying to add an average transaction duration overlay (global not by host) to the chart by adding to the search term: "| eventstats avg(max(duration)) as average | eval average=round(average,0)" and selecting "average" as the overlay value. The overlay is blank.

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

martin_mueller — Thu, 30 Oct 2014 20:25:31 GMT

Your search is shooting blanks because there is no field duration in the results of your timechart. Try this:

... | timechart ... by host | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=_total | eval average = _total / _count

Configure the chart to overlay the field average.

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

bradj013 — Fri, 07 Nov 2014 19:23:34 GMT

Thanks for the quick response. Not sure how this works, but it does.

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

martin_mueller — Fri, 07 Nov 2014 19:42:10 GMT

Heh. A little walk-through: You have fields named after your hosts, so you can't access one field called duration. Calculating an average is the same as calculating a sum and a count, then dividing the two. That's what I'm doing here:

set up the counter
count how many fields (hosts) you have
sum up the values
divide the two

All that is done with _fieldnames starting with an underscore, so there's no need to hide them using fields - _count _total because the chart doesn't see them anyway... yeah, I'm lazy.

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

landen99 — Wed, 05 Aug 2015 22:30:03 GMT

Laziness in success drives efficiency.