Splunk Search

Average count of events per field grouped by another field

rmm1982
New Member
Hello All,
I'm a relative newbie and hoping the community can help me out. I'm kind of stuck on a query and I can't figure out how to get the correct results.
 
I have an event that has a referer and a txn_id. Multiple events with the same referer field can have the same txn_id.
 
 
RefererTxn_idresponse_time
googleabcd123442
googleabcd123443
googleabcd123444
google1234abcd45
google1234abcd46
google1234abcd47
google1234abcd48
yahooxyz123110
yahoo123xyx 120
yahoo123xyz130
 
What I am trying to do is get the average number of txn_ids per referer and the avg of response times for that. So something like this:
 
 
Refereravg(count txn_id)avg(response_time)
google3.544.5
yahoo1.5120
 
Any help would be appreciated.
Thanks!
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| stats dc(Txn_id) as unique_tx_ids count avg(response_time) as average by Referer
| eval average_count_txns_id=count/unique_tx_ids
0 Karma

rmm1982
New Member

Thanks! That seemed to do it

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...