Splunk Search

Average of count per second

vinraisf
New Member

I am trying to get average per second while using this query

Source= (logRecordType="V" OR logRecordType="U") earliest=2/25/2014:22:00:00 latest=2/25/2014:22:02:00 | stats count by logRecordType

I would like to get the average per second using this formula

(latest-earliest)= 2 minute = 120 seconds

Then if my Count for logRecordType="V" is 240 then it should be 2 = 240/120
And if my count for logRecordType="U" is 360 then it should be 3 = 360/120

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

try this

source=abc (logRecordType="V" OR logRecordType="U") earliest=2/25/2014:22:00:00 latest=2/25/2014:22:02:00 | addinfo | eval totalSecs=info_max_time - info_min_time | stats count by logRecordType, totalSecs | eval Avg=round(count/totalSecs,2) | table logRecordType, Avg

View solution in original post

kristian_kolb
Ultra Champion

Welcome to the forum vinraisf. If an answer to your question solves your problem, please mark the question as answered by ticking the check mark next to the correct answer. (like I did for you here)

You can also vote answers up or down if they were particularly helpful.

Happy Splunking,

K

0 Karma

vinraisf
New Member

That worked like a charm, thank you so much someson12! I really appreciate it.

0 Karma

somesoni2
Revered Legend

try this

source=abc (logRecordType="V" OR logRecordType="U") earliest=2/25/2014:22:00:00 latest=2/25/2014:22:02:00 | addinfo | eval totalSecs=info_max_time - info_min_time | stats count by logRecordType, totalSecs | eval Avg=round(count/totalSecs,2) | table logRecordType, Avg
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...