Dashboards & Visualizations

Min , Max functions not returning expected in search

LNS
Engager

Hi,

I have some single string log statements looking like the following:

 

INFO ControllerNameHere f1d46561-b382-4685-9d7a-ebd76f40c355 EXT | <action> | Time 80

 

I want to make a query that groups the <action> types and then calculates the min, max and avg of the Time part of the string. So far i have had success with average:

 

index=my_index* host=hostName EXT | rex field=_raw "(EXT \| )(?<CategoryString>.+)( \| Time)" | rex field=_raw "(\| Time)(?<TimeValue>.+)" | stats mean(TimeValue) BY CategoryString

 

which returns the mean value of all entries. The data foundation of the query looks like:

LNS_1-1634889752858.png

All is grouped by 4 actions per one request, meaning that the first action: has the following values: 80, 45, 71, 63, 458.

When i then run the above query i get a correct result with mean:

LNS_2-1634889863973.png

But when switching to e.g. max, i get a maximum value of 80. which seems wrong, however it corresponds to the latest value. What am i missing here?

 

Labels (1)
0 Karma
1 Solution

LNS
Engager

I forgot to add a space after my Time in the query:

| rex field=_raw "(EXT \| )(?<CategoryString>.+)( \| Time)" | rex field=_raw "(\| Time )(?<TimeValue>.+)" | stats count, mean(TimeValue) as Average BY CategoryString | table CategoryString count Average

I assume the value was then read as a string instead of a number.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not sure but I wouldn't be surprised if mean() did some implicit casting to a numeric value while max() treated the field as text (thus max value in the lexicographic order would indeed be "80"). Try casting it to a number field by

| eval TimeValue=tonumber(TimeValue)

 and then doing your stats

0 Karma

LNS
Engager

I forgot to add a space after my Time in the query:

| rex field=_raw "(EXT \| )(?<CategoryString>.+)( \| Time)" | rex field=_raw "(\| Time )(?<TimeValue>.+)" | stats count, mean(TimeValue) as Average BY CategoryString | table CategoryString count Average

I assume the value was then read as a string instead of a number.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...