topic Re: Splunk average for particular count in Splunk Search

Splunk average for particular count

allladin101 — Thu, 06 Nov 2014 14:05:37 GMT

I am attempting to find half–hourly average of elapsed time for the GETXML message has exceeded 2,000ms for an half- hourly message count of 30,000 or more. I have the below query, BUT i am not sure how can add a check for this part "half- hourly message count of 30,000 or more" in the below query ?

can someone help

index=whatever* sourcetype=server GetXML timing=* | timechart span=30m avg(timing) by blob_type

Re: Splunk average for particular count

somesoni2 — Thu, 06 Nov 2014 15:37:57 GMT

Try this

index=whatever* sourcetype=server GetXML timing=* | bucket span=30m _time | stats avg(timing) as avgtiming count by blob_type, _time | where count>30000 | timechart span=30m avg(avgtiming) by blob_type

Re: Splunk average for particular count

allladin101 — Thu, 06 Nov 2014 16:43:32 GMT

doesnt seem to work 😞

This part doesnt seems to be working:

where count>30 | timechart span=30m avg(avgtiming) by blob_type

Re: Splunk average for particular count

somesoni2 — Thu, 06 Nov 2014 17:11:33 GMT

Missed including the _time field. Check the updated answer

Re: Splunk average for particular count

allladin101 — Thu, 06 Nov 2014 18:14:42 GMT

works now - thanks 🙂