Splunk Search

Average duration in Timechart

cclva
Explorer

Hello, new to Splunk and would appreciate some guidance. 

I want to create a timechart query to use for a dashboard to display the average response time over 24h as a trend. This is what I have so far: 

 

index= ... 
| stats min(_time) as min_t max(_time) as max_t by uniqueId
| eval duration = (max_t - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur

 

This returns an empty table as a response with no average duration values. If I return just before the timechart command, I get a table with all my log responses with the correct duration. 

Could I get some guidance on why timechart isn't returning the average durations over 24h?

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time

index= ... 
| stats min(_time) as min_t max(_time) as _time by uniqueId
| eval duration = (_time - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time

index= ... 
| stats min(_time) as min_t max(_time) as _time by uniqueId
| eval duration = (_time - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...