Splunk Search

Average Count doesn't show?

Motivator

Hi,

I have this query

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"|stats count avg(count) by host

And the results look like this

alt text

The count shows but no average count.... what am I missing?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try.

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"| bucket span=1d _time |stats count  by _time host | stats sum(count) as count avg(count) as avg by host

Replace avg with trend line for other requirement.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Give this a try.

earliest=-4d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"| bucket span=1d _time |stats count  by _time host | stats sum(count) as count avg(count) as avg by host

Replace avg with trend line for other requirement.

View solution in original post

0 Karma

Motivator

Thanks somesoni2!!! Worked great!!!

0 Karma

SplunkTrust
SplunkTrust

You can't use avg(count) as the field count is not available before stats. What you want to show in avg count?

0 Karma

Motivator

the average by day for each host

0 Karma

Motivator

I'm guessing the same applies for Trendline?

earliest=-45d index=wls OR index=main "ServletRequestImpl.java:2768" OR "rest path:/rest spec-version:2.5]] Servlet failed with Exception"|timechart  span=1d count by host| trendline sma2(count) as Trend

On this query I get the same count by host but no trendline

0 Karma