Splunk Search

Average Field results based of matching two other fields.

robmillers
Engager

Looking to take the following data sample and average the Latency columns based off the matching of Out and In fields. I've already taken the main search string and built reports around a rt timechart of average sorted by either Out or In; but would like a report that would show the average over 1 hr by distinct In & Out uniqueness

Example:

Latency, In, Out

00:00:01 SourceA SourceB

00:00:40 SourceA SourceC

00:00:01 SourceA SourceB

00:00:01 SourceB SourceB

00:00:01 SourceA SourceC

00:00:02 SourceA SourceC

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceB SourceA

00:00:01 SourceA SourceB

00:00:30 SourceB SourceC

I've already taken the main search string and built reports around a rt average sorted by either Out or In.

Would like it to look for any "In" and "Out" match them up and calculate the average of each one. With the above example it would be:

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceB SourceB

00:00:01 SourceA SourceC

00:00:02 SourceA SourceC

00:00:40 SourceA SourceC

00:00:01 SourceB SourceA

00:00:30 SourceB SourceC

Result Table desired outcome:

Latency, In, Out

00:00:01, SourceA, SourceB

00:00:01, SourceB, SourceB

00:00:14, SourceA, SourceC

00:00:01. SourceB, SourceA

00:00:30, SourceB, SourceC

I would also be performing the same eval of Latency to show the max but figure that would be a simple change of performing the above by using max( ) instead of avg( ).

Hopefully this makes sense.

Best Regards,

0 Karma
1 Solution

lguinn2
Legend

Why not

yoursearchhere
| latInSec = strptime(Latency,"%H:%M:%S")
| stats avg(latInSec) by In Out
| eval Average_Latency = tostring(latInSec,"duration")
| fields - latInSec

View solution in original post

lguinn2
Legend

Why not

yoursearchhere
| latInSec = strptime(Latency,"%H:%M:%S")
| stats avg(latInSec) by In Out
| eval Average_Latency = tostring(latInSec,"duration")
| fields - latInSec

robmillers
Engager

Thanks worked great, though I did take out the time format conversion as its done prior. Guess the stats is the main function to perform a calculations based on grouping of other fields I was looking for.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...