Dashboards & Visualizations

Graph to show averages for moving events over a particular period.

ballyp
Engager

Hi I'm looking to create a graph to show the moving 'average time' for multiple events.

The initial search is :
index=wpap host=ukdc*-pc-apa* source="E:\LogFiles\NotificationsManager\Operations.log" | search "Notification Complete"

Within this events there is a key 'totalDuration=9563'

This duration is in seconds for the 'notification process to complete.

I would like to show the moving average for all 'Notification complete' events using the 'TotalDuration' time over a 5 minute period.

Please help!

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

We just did this for a very similar case. https://answers.splunk.com/answers/522301/how-to-create-and-calculate-a-response-time-graph.html

Here's the version for splunk 6.4+...

earliest=-16m@m
index=wpap host=ukdc*-pc-apa* 
source="E:\\LogFiles\\NotificationsManager\\Operations.log" 
"Notification Complete"
| bin _time span=10s
| stats avg(totalDuration) as totalDuration by _time
| streamstats time_window=5m avg(totalDuration) as avgDuration 
| addinfo
| bin info_max_time as maxtime span=10s 
| where (_time >= info_min_time+300) and (_time < maxtime)
| timechart span=10s avg(avgDuration ) as avgDuration 

Here's a version for earlier versions of splunk...

earliest=-16m@m
index=wpap host=ukdc*-pc-apa* 
source="E:\\LogFiles\\NotificationsManager\\Operations.log" 
"Notification Complete"
| bin _time span=10s
| stats avg(totalDuration) as totalDuration by _time
| eval timefan=mvrange(0,300,10)
| stats avg(totalDuration) as avgDuration by _time
| addinfo
| bin info_max_time as maxtime span=10s 
| where (_time >= info_min_time+300) and (_time < maxtime)
| timechart span=10s avg(avgDuration ) as avgDuration 

Both of the above present the trailing 5-minute moving average for events from ten minutes ago to the present, in 10-second increments.

View solution in original post

0 Karma

DalJeanis
Legend

We just did this for a very similar case. https://answers.splunk.com/answers/522301/how-to-create-and-calculate-a-response-time-graph.html

Here's the version for splunk 6.4+...

earliest=-16m@m
index=wpap host=ukdc*-pc-apa* 
source="E:\\LogFiles\\NotificationsManager\\Operations.log" 
"Notification Complete"
| bin _time span=10s
| stats avg(totalDuration) as totalDuration by _time
| streamstats time_window=5m avg(totalDuration) as avgDuration 
| addinfo
| bin info_max_time as maxtime span=10s 
| where (_time >= info_min_time+300) and (_time < maxtime)
| timechart span=10s avg(avgDuration ) as avgDuration 

Here's a version for earlier versions of splunk...

earliest=-16m@m
index=wpap host=ukdc*-pc-apa* 
source="E:\\LogFiles\\NotificationsManager\\Operations.log" 
"Notification Complete"
| bin _time span=10s
| stats avg(totalDuration) as totalDuration by _time
| eval timefan=mvrange(0,300,10)
| stats avg(totalDuration) as avgDuration by _time
| addinfo
| bin info_max_time as maxtime span=10s 
| where (_time >= info_min_time+300) and (_time < maxtime)
| timechart span=10s avg(avgDuration ) as avgDuration 

Both of the above present the trailing 5-minute moving average for events from ten minutes ago to the present, in 10-second increments.

0 Karma

ballyp
Engager

thanks that's working great, I used the search just before the 'Where' parameter as it was showing 'null data'

Thanks this is just what I need to work with.

Paul

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...