Dashboards & Visualizations

Graph hourly events multiplied by avgevent duration (in hours),

c799651
Explorer

Hi I have data with captures events (phone calls). I would like to graph in hourly buckets the total calls per hour multiplied by the avg call duration.

I have fumbled around and been able to present the two components in separate charts but failed when trying to merge both charts into one with the multiplication performed.

First Search

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H")
| stats count AS B_Number first(date_hour) AS date_hour BY _time
| stats avg(B_Number) BY date_hour

Second Search.

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H") | eval Callhours=CallDurationSecs/3600
| stats avg(Callhours) BY date_hour

How do I combine these searches with the muliplication applied.
Eg Search 1 Hour 1 result equals .00112299
Search 1 Hour 1 result equals 35555
Desired result for hour 1 399.21 (.00112299*35555)

Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

View solution in original post

0 Karma

c799651
Explorer

Thanks very much this worked. But when I used "visualisation" Splunk is graphing A, B and result by hour.
How do I just show result by Hour in the column chart?

Thanks Again

0 Karma

c799651
Explorer

think I worked it out. Just added

| stats avg(result) by date_hour

0 Karma

to4kawa
Ultra Champion
index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...