Splunk Search

Adding avg and changing min to minutes

eb1929
Explorer

Ill start off i am newer to splunk.... 

 

I am using the following search 

index=server source="WinEvent" EventCode=1234 OR EventCode=5678
| eval locked_account_name=mvindex(Account_Name, 1)
| eval account_that_unlokcedit=mvindex(Security_ID, 0)
| transaction startswith="locked out" endswith="unlocked"
| stats sum(duration) as duration by locked_account_name account_that_unlokcedit
| eval min=duration/60
| eval min=round(min,2)
| search account_that_unlokcedit=*APP1234* OR account_that_unlokcedit=*z_xxx* OR account_that_unlokcedit=*APP56789*

 

I need to chang the min column to minutes..... then i need to get the average of that column(minutes) and put the average in its own column  

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
...
| rename min as minutes
| eventstats avg(minutes) as avgMinutes
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
...
| rename min as minutes
| eventstats avg(minutes) as avgMinutes
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...