Dashboards & Visualizations

two aggregations? latest and average


I'm trying to look at the last result of code coverage for repo and then average that out for the team each month. 
It would be something like this below but nesting a latest within an average doesn't work.

| timechart span=1mon avg(latest(codecoverage.totalperc) by reponame) by team

With this, I foresee an issue where the repos built every month aren't static but dynamic. I was looking at streamstats to see how the events change over time, but still can only get it grouped by reponame or by team and can't get it groupd by both

| timechart span=1mon latest(codecoverage.totalperc) as now by reponame
|untable _time,reponame,now
|sort reponame
|streamstats current=f window=1 last(now) as prev by reponame
|eval Difference=now-prev
| maketable _time,reponame,Difference


Labels (1)
0 Karma


Try something like this

| sort 0 _time
| bin _time span=1mon
| stats last(codecoverage.totalperc) as coverage by _time reponame team
| timechart span=1mon avg(coverage) as average_coverage by team


I think you have the right idea by using streamstats and timechart, but you have them in the wrong order.  Try this untested SPL as an alternative to nesting latest within avg.

| streamstats latest(codecoverage.totalperc) as totalperc by reponame
| timechart span=1mon avg(totalperc) as avgtotalperc by team


If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...