Splunk Search

Average count of events per field grouped by another field

rmm1982
New Member
Hello All,
I'm a relative newbie and hoping the community can help me out. I'm kind of stuck on a query and I can't figure out how to get the correct results.
 
I have an event that has a referer and a txn_id. Multiple events with the same referer field can have the same txn_id.
 
 
RefererTxn_idresponse_time
googleabcd123442
googleabcd123443
googleabcd123444
google1234abcd45
google1234abcd46
google1234abcd47
google1234abcd48
yahooxyz123110
yahoo123xyx 120
yahoo123xyz130
 
What I am trying to do is get the average number of txn_ids per referer and the avg of response times for that. So something like this:
 
 
Refereravg(count txn_id)avg(response_time)
google3.544.5
yahoo1.5120
 
Any help would be appreciated.
Thanks!
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| stats dc(Txn_id) as unique_tx_ids count avg(response_time) as average by Referer
| eval average_count_txns_id=count/unique_tx_ids
0 Karma

rmm1982
New Member

Thanks! That seemed to do it

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...