Splunk Search

Average Field Value per Second


Hi there, I have a problem and think I know the cause. Looking for the work around. I am sending periodic logs to Splunk which contains count information and want to timechart the Fixtures per second. For example:

FeedSource="A" Sport="Football" Fixtures=20

The message is sent every 10 seconds so the fix/ps should be 2. But how can I get this to work across any time frame I am looking at?

So if I am looking at 1 day and each point represents an hour, the count must be divided by 3600. Whereas if I am looking at 1 minute and each point on the graph represents 1 second, the count must be divided by 1.

avg(X) cannot be used because some log messages will contain Fixtures=0 which will bring the average per second down.

Thanks in advance for any help!

Tags (2)
1 Solution


Path Finder

This only works on timechart... not stats.


Holy moly... feel bad!

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...