Archive

How i can calculate average of each event type

Amandeepsin
New Member

index="sc-general" info AND(heartbeat OR Successfully) NOT(created) | rex ":\s+(?\w+)" | eval entry_type=if(entry_type == "Successfully", "File", entry_type) | timechart count by entry_type

Now, I want to calculate average of each event type on this chart. help me with this

Tags (1)
0 Karma

Richfez
SplunkTrust
SplunkTrust

Your search came through a bit garbled, but I believe you can just change your timechart at the end to

| timechart count, avg(MyField) by entry_type

filling in whatever "MyField" that you wanted to average was.

0 Karma

Richfez
SplunkTrust
SplunkTrust

If this worked for you, could you please Accept the Answer so that others searching here will benefit?

Thanks!
Rich

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!