topic Calculate a number from each entry and present the average of all entries in Splunk Search

Calculate a number from each entry and present the average of all entries

thewho123 — Fri, 20 May 2016 01:07:29 GMT

I have the entries below from different sessions:

sessionId="001" data="[{message=timing_stats, data=[{beginF=1550652.855, endF=1550719.130001}, {beginF=1565741, endF=1565787}, {beginF=1574747, endF=1574782}]}]" 

sessionId="002" data="[{message=timing_stats, data=[{beginF=1510652.855, endF=1550719.1001}, {beginF=1865741.4500000002, endF=1565787.645}, {beginF=1974747.655, endF=1974782.6050000002}]}]"

What I want to do is to calculate endF-beginF for each object in the data array. In this case I would have 3 from the session 001 and 3 from session 002. Then I would like to show the average of the six numbers in a graph. How would I accomplish this? -Thanks.

Re: Calculate a number from each entry and present the average of all entries

sundareshr — Fri, 20 May 2016 02:14:12 GMT

Try this

your base search | rex max_match=0 "beginF=(?<begin>\d+\.?\d*),\sendF=(?<end>\d+\.?\d*)" | eval z=mvzip(begin, end) | mvexpand z | rex field=z "^(?<begin>[^,]+),(?<end>.*)$" | stats count avg(begin) AS begin avg(end) AS end by sessionId

Re: Calculate a number from each entry and present the average of all entries

thewho123 — Fri, 20 May 2016 17:52:32 GMT

Hi,
This creates a table with sessionId, count, begin, end columns. I needed the average of endF (minus) beginF from each object and calculate their average.

Re: Calculate a number from each entry and present the average of all entries

sundareshr — Fri, 20 May 2016 18:06:34 GMT

This should give you that...

your base search | rex max_match=0 "beginF=(?<begin>\d+\.?\d*),\sendF=(?<end>\d+\.?\d*)" | eval z=mvzip(begin, end) | mvexpand z | rex field=z "^(?<begin>[^,]+),(?<end>.*)$" | eval diff=end-begin | stats count avg(begin) AS begin avg(end) AS end avg(diff) as diff by sessionId

Re: Calculate a number from each entry and present the average of all entries

thewho123 — Thu, 26 May 2016 01:22:30 GMT

I am trying to calculate each pair separately. {beginF=1550652.855, endF=1550719.130001} and then get average of each calculated value
These will be timing values so (total beginF - total endF) will not work..