Splunk Search

Average Count doesn't show?

dbcase
Motivator

Hi,

I have this query

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"|stats count avg(count) by host

And the results look like this

alt text

The count shows but no average count.... what am I missing?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try.

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"| bucket span=1d _time |stats count  by _time host | stats sum(count) as count avg(count) as avg by host

Replace avg with trend line for other requirement.

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try.

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"| bucket span=1d _time |stats count  by _time host | stats sum(count) as count avg(count) as avg by host

Replace avg with trend line for other requirement.

0 Karma

dbcase
Motivator

Thanks somesoni2!!! Worked great!!!

0 Karma

somesoni2
Revered Legend

You can't use avg(count) as the field count is not available before stats. What you want to show in avg count?

0 Karma

dbcase
Motivator

the average by day for each host

0 Karma

dbcase
Motivator

I'm guessing the same applies for Trendline?

earliest=-45d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"|timechart  span=1d count by host| trendline sma2(count) as Trend

On this query I get the same count by host but no trendline

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...