Dashboards & Visualizations

Graph hourly events multiplied by avgevent duration (in hours),

c799651
Explorer

Hi I have data with captures events (phone calls). I would like to graph in hourly buckets the total calls per hour multiplied by the avg call duration.

I have fumbled around and been able to present the two components in separate charts but failed when trying to merge both charts into one with the multiplication performed.

First Search

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H")
| stats count AS B_Number first(date_hour) AS date_hour BY _time
| stats avg(B_Number) BY date_hour

Second Search.

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H") | eval Callhours=CallDurationSecs/3600
| stats avg(Callhours) BY date_hour

How do I combine these searches with the muliplication applied.
Eg Search 1 Hour 1 result equals .00112299
Search 1 Hour 1 result equals 35555
Desired result for hour 1 399.21 (.00112299*35555)

Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

View solution in original post

0 Karma

c799651
Explorer

Thanks very much this worked. But when I used "visualisation" Splunk is graphing A, B and result by hour.
How do I just show result by Hour in the column chart?

Thanks Again

0 Karma

c799651
Explorer

think I worked it out. Just added

| stats avg(result) by date_hour

0 Karma

to4kawa
Ultra Champion
index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...