Splunk Search

Average of session duration

keshab
Path Finder

search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID

I got the each session duration using the above command. Now how do I calculate the average of all those session duration??

Tags (1)

hjwang
Contributor

if you only wanna show final result , just

SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duraion_sec)

else if you wanna append to first result

SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | append [ search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duraion_sec)]

Here I think the Splunk should expand some calculating functions to add rows like addcoltotals to summarize the table results. If some of this have been existed, please let me know. Thanks!!

0 Karma

kristian_kolb
Ultra Champion

just pipe it through stats again

| stats avg(Session_Duration_Sec)

/kristian

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...