Splunk Search

Average of value during last running state

aseadmin
Explorer

I am having data as shown in the below image,

alt text

Is there a way i can get the avg of output considering the data for state is running; but only from the last time state was changed to running and not for a specific time period

The data to be considered for finding the avg is marked in grey in the image attached

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your current searching fetching data with timestamp(_time), state and output fields
| eventstats max(eval(if(state="start",_time,null()))) as lastStart
| where _time>=lastStart AND state="running"
| stats avg(output) as Avg_Output

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your current searching fetching data with timestamp(_time), state and output fields
| eventstats max(eval(if(state="start",_time,null()))) as lastStart
| where _time>=lastStart AND state="running"
| stats avg(output) as Avg_Output

aseadmin
Explorer

thank you. it was my mistake. i was having field sent over http input as json and i was accessing the field as message.state but infact i had to have single qoutes around it as 'message.state'. thank you once again

0 Karma

aseadmin
Explorer

thank you for giving me something to start with but eventstats max(eval(if(state="start",_time,null()))) as lastStart is always giving null. i am sure i have entries with state = start; infact i tried changing to eventstats max(eval(if(state="running",_time,null()))) as lastStart to see if i am getting some match on if condition

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...