Dashboards & Visualizations

Graph hourly events multiplied by avgevent duration (in hours),

Explorer

Hi I have data with captures events (phone calls). I would like to graph in hourly buckets the total calls per hour multiplied by the avg call duration.

I have fumbled around and been able to present the two components in separate charts but failed when trying to merge both charts into one with the multiplication performed.

First Search

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H")
| stats count AS B_Number first(date_hour) AS date_hour BY _time
| stats avg(B_Number) BY date_hour

Second Search.

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H") | eval Callhours=CallDurationSecs/3600
| stats avg(Callhours) BY date_hour

How do I combine these searches with the muliplication applied.
Eg Search 1 Hour 1 result equals .00112299
Search 1 Hour 1 result equals 35555
Desired result for hour 1 399.21 (.00112299*35555)

Tags (2)
0 Karma
1 Solution

Ultra Champion
index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

View solution in original post

0 Karma

Explorer

Thanks very much this worked. But when I used "visualisation" Splunk is graphing A, B and result by hour.
How do I just show result by Hour in the column chart?

Thanks Again

0 Karma

Explorer

think I worked it out. Just added

| stats avg(result) by date_hour

0 Karma

Ultra Champion
index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

View solution in original post

0 Karma