Archive

Use TimePicker to average on a specific field

Explorer

I have a dashboard with several inputs to include a timepicker, one of my panels charts the sums of specific fields over the time picked. I would like to add another column that acts upon one of those sums and get the avg per minute.

For example time picked is 4 hours
Column 1 = 480

The new column would then need to take that result and divide it by the number of minutes specified in the time picker
480/240minutes = 2 per minute

Tags (1)
0 Karma
1 Solution

Revered Legend

Try this. The eval on 2nd last line will add a field called Minutes, containing number of minutes in the selected timerange. You can use that for your 'per min' calculation.

index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput 
| eval Minutes=[| gentimes start=-1 | addinfo | eval search=round((info_max_time-info_min_time)/60) | table search] 
| eval MSG_1_COUNT_PerMin=MSG_1_COUNT/Minutes | fields - Minutes

View solution in original post

SplunkTrust
SplunkTrust

It's going to look something like

| eval PerMinute = 60*MSG_1_COUNT / ($timerange.latest$ - $timerange.earliest$)

Revered Legend

Try this. The eval on 2nd last line will add a field called Minutes, containing number of minutes in the selected timerange. You can use that for your 'per min' calculation.

index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput 
| eval Minutes=[| gentimes start=-1 | addinfo | eval search=round((info_max_time-info_min_time)/60) | table search] 
| eval MSG_1_COUNT_PerMin=MSG_1_COUNT/Minutes | fields - Minutes

View solution in original post

SplunkTrust
SplunkTrust

cute. I hadn't thought of using addinfo instead of pulling it off the interface.

0 Karma

Champion

The community can best help you if you share part or whole of your search query. That way we can more efficiently help by targeting the specific fields and commands you are using.

Explorer

My search looks like the following
index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput

I would like an additional column that per NAME looks at the sum of MSG_1_COUNT for that NAME and divides it by the number of minutes that will be specified in the timepicker input so I can get average MSG_1_COUNT per Minute
Thanks

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!