Dashboards & Visualizations

How to show Average time for last 7 days in minutes

aditsss
Motivator

Hi Team,

I am currently using below query:

 

 

index="abc"
sourcetype =$Regions$ 
source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" 
| rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
|eval duration=floor(duration/60)
| sort _time

 

 

I am able to see last 7days data individually

Time.PNG

I want one panel where I can check for average for last 7 days like average of all that 7 days time.

Can someone guide.

Labels (3)
0 Karma

aditsss
Motivator

@jotne 

Currently with my query I am able to see day wise I want average of it 

Either I should select 1 week or 30 days or 60 days.

My current query

index="600000304_d_gridgain_idx*" sourcetype =$Regions$ source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process" | timechart avg(duration) as duration span=1d|eval duration=floor(duration/60)| sort _time

 

0 Karma

jotne
Builder

Not sure if I understand the request.

 

| timechart span=1month avg(duration) as duration

 

Or average for week over month.

| timechart span=1d avg(duration) as duration
| timewrap 1w

 

0 Karma

aditsss
Motivator

@jotne 

As of now it's by default 7 days but on date/ filter we can select anything

On that what should be out query 

0 Karma

jotne
Builder

Not clear at all.  You can make a dashboard where you can dynamically select timespan.

0 Karma

jotne
Builder

What about:

| timechart span=1w avg(duration) as duration
0 Karma

aditsss
Motivator

@jotne 

It's not only about week if I should select last 30 days it should show the average

0 Karma

jotne
Builder

Then you make a dashbord with time picker to select 1day, 1 week or 1 month.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...