https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177776#M51102 <P>Try something like this. Assuming you're looking for Avg Min and Max count per min for the 7 day period.</P> <PRE><CODE>index=apihits app=specificapp earliest=-7d |bucket _time span=1m | stats count by _time | stats min(count) as min max(count) as min avg(count) as avg </CODE></PRE> <P>Idea is to use bucket to define time-part, use stats to generate count for each min (per min count) and then generate the stats from per min count</P> Tue, 18 Aug 2015 21:40:03 GMT somesoni2 2015-08-18T21:40:03Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177772#M51098 <P>I'm trying to find the avg, min, and max values of a 7 day search over 1 minute spans.</P> <P>For example:</P> <PRE><CODE>index=apihits app=specificapp earliest=-7d </CODE></PRE> <P>I want to find:<BR /> 1. what is the max per minute<BR /> 2. what is the avg per minute<BR /> 3. what is the lowest per minute</P> <P>I know it uses min(field), max(field) and avg(field), but for the life of me I can't get it to work. Can someone please tell me what I'm doing wrong?</P> Tue, 18 Aug 2015 21:04:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177772#M51098 tkwaller 2015-08-18T21:04:42Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177773#M51099 <P>What have you tried so far? We can't say what you're doing wrong without knowing what you are doing.</P> Tue, 18 Aug 2015 21:08:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177773#M51099 richgalloway 2015-08-18T21:08:36Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177774#M51100 <P>index=apihits app=specificapp earliest=-7d |bucket _time span=1m|stats count as somename, avg(field) as AvgValue<BR /> min(field) as MinValue max(field) as MaxValue by somefield </P> <P>Since you want it by minute, the key is bucket all data in per minute.</P> Tue, 18 Aug 2015 21:10:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177774#M51100 jensonthottian 2015-08-18T21:10:20Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177775#M51101 <P>This is what I was trying to do:</P> <PRE><CODE>index=apihits app=specificapp earliest=-7d | bucket _time span=1min | stats count AS totalCalls, avg(totalCalls) AS AvgCallPerMin, min(totalCalls) AS MinCallsPerMin, max(totalCalls) AS MaxCallsPerMin </CODE></PRE> Tue, 18 Aug 2015 21:38:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177775#M51101 tkwaller 2015-08-18T21:38:35Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177776#M51102 <P>Try something like this. Assuming you're looking for Avg Min and Max count per min for the 7 day period.</P> <PRE><CODE>index=apihits app=specificapp earliest=-7d |bucket _time span=1m | stats count by _time | stats min(count) as min max(count) as min avg(count) as avg </CODE></PRE> <P>Idea is to use bucket to define time-part, use stats to generate count for each min (per min count) and then generate the stats from per min count</P> Tue, 18 Aug 2015 21:40:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177776#M51102 somesoni2 2015-08-18T21:40:03Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177777#M51103 <P>Of course, that exactly what I left out, count by _time. Thanks for the help. My brain is just burnt for today.</P> Tue, 18 Aug 2015 21:43:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177777#M51103 tkwaller 2015-08-18T21:43:44Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177778#M51104 <P>Hello,</P> <P>And if I want to do so on a 7 day timechart (the max, min and avg value, for each day of the last 7 days)<BR /> How do I modify this request please ?</P> <P>Moreover, the above solution (the first one) gives me a chart with only two columns :<BR /> max column<BR /> avg column<BR /> ... but min is on absciss axis ans is not shown as a dedicated column.</P> <P>I have to hover my mouse onto one of the columns to see the min value (or look in the table below)</P> <P>Any idea ?</P> <P>Thank you</P> Mon, 05 Dec 2016 09:27:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/177778#M51104 zebu14 2016-12-05T09:27:10Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/650298#M224805 <P>My use case is to find the highest traffic per minute. Is this possible to find the time as well to identify when the spike in traffic happened ?</P> Wed, 12 Jul 2023 21:51:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-min-and-max-values-per-minute-for-a-7/m-p/650298#M224805 RemyaT 2023-07-12T21:51:23Z