Dashboards & Visualizations

Get average from multiple field in XML

yurykiselev
Path Finder

Hi!
I have XML-events with different name values:

<reactiontimes>
<rt1>1.42</rt1>
<rt2>1.31</rt2>
<rt3>1.33</rt3>
...
<rtN>X.XX</rtN>
</ractiontimes>

How can I get AVG of rt* for each event?
Thank you!

0 Karma
1 Solution

dineshraj9
Builder

Try this way -

index="dynavision" | streamstats count as event_count by _raw | rex max_match=0 "rt\d\>(?<REACTION_TIME>[\d\.]+)" | table _raw event_count REACTION_TIME | mvexpand REACTION_TIME | stats avg(REACTION_TIME) as AVG_REACTION_TIME by _raw event_count | fields - event_count | eval AVG_REACTION_TIME=round(AVG_REACTION_TIME,2)

View solution in original post

woodcock
Esteemed Legend

Try this:

Your Base Search Here | streamstats count AS serial | fields serial rt* | untable serial rt_stuff count | stats avg(count) BY serial

That gives the avg of the values inside of each event. From there you can easily get further averages across events.

0 Karma

dineshraj9
Builder

Try this way -

index="dynavision" | streamstats count as event_count by _raw | rex max_match=0 "rt\d\>(?<REACTION_TIME>[\d\.]+)" | table _raw event_count REACTION_TIME | mvexpand REACTION_TIME | stats avg(REACTION_TIME) as AVG_REACTION_TIME by _raw event_count | fields - event_count | eval AVG_REACTION_TIME=round(AVG_REACTION_TIME,2)

yurykiselev
Path Finder

Thank you!

0 Karma

yurykiselev
Path Finder

Found something:

index="dynavision" | eval rt_sum = 0 | eval rt_count = 0 | foreach modeBdata.red.reactiontimes.rt* [eval rt_count = rt_count + 1 | eval rt_sum = rt_sum + '<<FIELD>>' ] | eval rt_avg = rt_sum / rt_count

But it seems works only for first event((

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...