Dashboards & Visualizations

Average of Ack _time for each day over week

mangeshtonde
Observer

I have created a dashboard with the help of join which extract data in below format. Incoming event is mapped with outgoing event and time difference is displayed(AcK_time) 

IncEvntIDTime                        IncoingEventID            OutEvntIDTime                             OutgngEvntID       Ack_time
13 Dec 2020  14:55:52   X12356565                   13 Dec 2020 14:55:54          X12356565                2
13 Dec 2020 14:55:53    X12356567                    13 Dec 2020 14:55:54          X12356567                2

Problem statement: I want average of Ack _time for each day over week in below format.

Date               Avg of Ack_time

Monday        2

Tuesday       3

Wednesday  3

and so on.....

Thanks in advance!!

@woodcock 

Labels (1)
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults
| eval _raw="IncEvntIDTime,IncoingEventID,OutEvntIDTime,OutgngEvntID,Ack_time
13 Dec 2020 14:55:52,X12356565,13 Dec 2020 14:55:54,X12356565,2
13 Dec 2020 14:55:53,X12356567,13 Dec 2020 14:55:54,X12356567,2"
| multikv forceheader=1
| fields - _raw linecount
| eval _time = strptime(IncEvntIDTime, "%d %b %Y %H:%M:%S")

| eval date_weekday = strftime(_time, "%A")
| stats avg(Ack_time) BY date_weekday
0 Karma

mangeshtonde
Observer

@woodcock - Thank you for your reply, but it didn't work.

 

 

 

 

 

 

 

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...