Splunk Search

Average Field results based of matching two other fields.

robmillers
Engager

Looking to take the following data sample and average the Latency columns based off the matching of Out and In fields. I've already taken the main search string and built reports around a rt timechart of average sorted by either Out or In; but would like a report that would show the average over 1 hr by distinct In & Out uniqueness

Example:

Latency, In, Out

00:00:01 SourceA SourceB

00:00:40 SourceA SourceC

00:00:01 SourceA SourceB

00:00:01 SourceB SourceB

00:00:01 SourceA SourceC

00:00:02 SourceA SourceC

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceB SourceA

00:00:01 SourceA SourceB

00:00:30 SourceB SourceC

I've already taken the main search string and built reports around a rt average sorted by either Out or In.

Would like it to look for any "In" and "Out" match them up and calculate the average of each one. With the above example it would be:

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceA SourceB

00:00:01 SourceB SourceB

00:00:01 SourceA SourceC

00:00:02 SourceA SourceC

00:00:40 SourceA SourceC

00:00:01 SourceB SourceA

00:00:30 SourceB SourceC

Result Table desired outcome:

Latency, In, Out

00:00:01, SourceA, SourceB

00:00:01, SourceB, SourceB

00:00:14, SourceA, SourceC

00:00:01. SourceB, SourceA

00:00:30, SourceB, SourceC

I would also be performing the same eval of Latency to show the max but figure that would be a simple change of performing the above by using max( ) instead of avg( ).

Hopefully this makes sense.

Best Regards,

0 Karma
1 Solution

lguinn2
Legend

Why not

yoursearchhere
| latInSec = strptime(Latency,"%H:%M:%S")
| stats avg(latInSec) by In Out
| eval Average_Latency = tostring(latInSec,"duration")
| fields - latInSec

View solution in original post

lguinn2
Legend

Why not

yoursearchhere
| latInSec = strptime(Latency,"%H:%M:%S")
| stats avg(latInSec) by In Out
| eval Average_Latency = tostring(latInSec,"duration")
| fields - latInSec

robmillers
Engager

Thanks worked great, though I did take out the time format conversion as its done prior. Guess the stats is the main function to perform a calculations based on grouping of other fields I was looking for.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...