Splunk Search

Average count of events per field grouped by another field

rmm1982
New Member
Hello All,
I'm a relative newbie and hoping the community can help me out. I'm kind of stuck on a query and I can't figure out how to get the correct results.
 
I have an event that has a referer and a txn_id. Multiple events with the same referer field can have the same txn_id.
 
 
RefererTxn_idresponse_time
googleabcd123442
googleabcd123443
googleabcd123444
google1234abcd45
google1234abcd46
google1234abcd47
google1234abcd48
yahooxyz123110
yahoo123xyx 120
yahoo123xyz130
 
What I am trying to do is get the average number of txn_ids per referer and the avg of response times for that. So something like this:
 
 
Refereravg(count txn_id)avg(response_time)
google3.544.5
yahoo1.5120
 
Any help would be appreciated.
Thanks!
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| stats dc(Txn_id) as unique_tx_ids count avg(response_time) as average by Referer
| eval average_count_txns_id=count/unique_tx_ids
0 Karma

rmm1982
New Member

Thanks! That seemed to do it

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...