Average latency per hour

[tmarlette]

I am attempting to find out the average latency of my requests by ip, per hour, over a 24 hour period. I'm sure i'm making this far too complicated, but it's friday at 5pm. 😃

The search I'm using:

website=services* NOT hck=* | bucket _time span=60min | stats avg(time_taken) by clientip

this is returning a single value, so i would assume that splunk is averaging the values per hour, and giving that single value? any help is appreciated!

[kristian_kolb · Accepted solution]

Your search does not take the time information into account;

website=services* NOT hck=* | bucket _time span=60min | stats avg(time_taken) by clientip, _time

OR

website=services* NOT hck* | timechart span=1h avg(time_taken) by clientip

is more likely what you need, but with many IP's the graph may not be all that nice.

/K