I am attempting to find out the average latency of my requests by ip, per hour, over a 24 hour period. I'm sure i'm making this far too complicated, but it's friday at 5pm. 😃
The search I'm using:
website=services* NOT hck=* | bucket _time span=60min | stats avg(time_taken) by clientip
this is returning a single value, so i would assume that splunk is averaging the values per hour, and giving that single value? any help is appreciated!
Your search does not take the time information into account;
website=services* NOT hck=* | bucket _time span=60min | stats avg(time_taken) by clientip, _time
website=services* NOT hck* | timechart span=1h avg(time_taken) by clientip
is more likely what you need, but with many IP's the graph may not be all that nice.
View solution in original post