Hi,
i have an requirement as like below.
TimeStamp | LoginUsers | Avg SLA | Min SLA | Max SLA |
20-02-2022 11:30 | 35 | 1 | 1 | 3.4 |
20-02-2022 11:45 | 40 | 1.3 | 1 | 5.3 |
20-02-2022 12:00 | 32 | 2.4 | 1 | 7.6 |
20-02-2022 12:15 | 53 | 1.2 | 1 | 4.2 |
20-02-2022 12:30 | 44 | 2.3 | 1 | 3.5 |
I have an above dashboard panel which was showing up on 15minutes span. Onclick of max SLA we are suppose to get the particular splunk log event in new tab. may i know how we can work on this.
Additionally, if you want to have the event opened up in a new tab upon clicking on the SLA value in the table, you will need to define drilldown and link it to a search. You can find the related information here - https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/DrilldownLinkToSearch
Be sure of using variables like $click.value$ and $click.value2$ while using drilldown to achieve proper use case
Hi @sahana,
I don't know how you want to calculate avg, max and min, if you could share some additional info (e.g. examples of your logs and the aggregation logic) I could help you better in this,.
Anyway, the approach is to bin your events using the bin command and then use the stats command.
So, if you have a duration value in your events, you could run a stats command like this:
index=your_index
| bin span=15m _time
| stats count AS LoginUsers avg(duration) AS "Avg SLA" min(duration) AS "Min SLA" max(duration) AS "Max SLA" BY _time
| TimeStamp=strftime(_time,"%d-%m-%Y %H:%M")
| table TimeStamp LoginUsers "Avg SLA" "Min SLA" "Max SLA"
Ciao.
Giuseppe