Dashboards & Visualizations

two aggregations? latest and average

Brandon_B
Engager

I'm trying to look at the last result of code coverage for repo and then average that out for the team each month. 
It would be something like this below but nesting a latest within an average doesn't work.

| timechart span=1mon avg(latest(codecoverage.totalperc) by reponame) by team


With this, I foresee an issue where the repos built every month aren't static but dynamic. I was looking at streamstats to see how the events change over time, but still can only get it grouped by reponame or by team and can't get it groupd by both


| timechart span=1mon latest(codecoverage.totalperc) as now by reponame
|untable _time,reponame,now
|sort reponame
|streamstats current=f window=1 last(now) as prev by reponame
|eval Difference=now-prev
| maketable _time,reponame,Difference

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| sort 0 _time
| bin _time span=1mon
| stats last(codecoverage.totalperc) as coverage by _time reponame team
| timechart span=1mon avg(coverage) as average_coverage by team

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea by using streamstats and timechart, but you have them in the wrong order.  Try this untested SPL as an alternative to nesting latest within avg.

| streamstats latest(codecoverage.totalperc) as totalperc by reponame
| timechart span=1mon avg(totalperc) as avgtotalperc by team

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...