Hello, new to Splunk and would appreciate some guidance.
I want to create a timechart query to use for a dashboard to display the average response time over 24h as a trend. This is what I have so far:
index= ...
| stats min(_time) as min_t max(_time) as max_t by uniqueId
| eval duration = (max_t - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur
This returns an empty table as a response with no average duration values. If I return just before the timechart command, I get a table with all my log responses with the correct duration.
Could I get some guidance on why timechart isn't returning the average durations over 24h?
stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time
index= ...
| stats min(_time) as min_t max(_time) as _time by uniqueId
| eval duration = (_time - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur
stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time
index= ...
| stats min(_time) as min_t max(_time) as _time by uniqueId
| eval duration = (_time - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur