Splunk Search

Average and Max of Timecharted output

siva_cg
Path Finder

Hi All,

I am trying to find out the average and maximum value from the timechart output but failed. Could you please help me to get the desired output?

For example:
index=_internal type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" |timechart span=1d eval(round(sum(b)/1024/1024/1024,1)) as GB |stats avg(GB) as Average max(GB) as Peak

Output: Average Peak
Desired Output: _time GB Average Peak

Thanks in advance.

Tags (1)
0 Karma

kmaron
Motivator

instead of using timechart try using a time bucket

index=_internal type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" 
| bucket _time span=1d
| stats sum(b) as b_sum by _time
| eval GB=(round(b_sum/1024/1024/1024,1))
| stats avg(GB) as Average max(GB) as Peak
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.