Splunk Search

Calculate a number from each entry and present the average of all entries

thewho123
Explorer

I have the entries below from different sessions:

sessionId="001" data="[{message=timing_stats, data=[{beginF=1550652.855, endF=1550719.130001}, {beginF=1565741, endF=1565787}, {beginF=1574747, endF=1574782}]}]" 

sessionId="002" data="[{message=timing_stats, data=[{beginF=1510652.855, endF=1550719.1001}, {beginF=1865741.4500000002, endF=1565787.645}, {beginF=1974747.655, endF=1974782.6050000002}]}]" 

What I want to do is to calculate endF-beginF for each object in the data array. In this case I would have 3 from the session 001 and 3 from session 002. Then I would like to show the average of the six numbers in a graph. How would I accomplish this? -Thanks.

0 Karma

sundareshr
Legend

Try this

your base search | rex max_match=0 "beginF=(?<begin>\d+\.?\d*),\sendF=(?<end>\d+\.?\d*)" | eval z=mvzip(begin, end) | mvexpand z | rex field=z "^(?<begin>[^,]+),(?<end>.*)$" | stats count avg(begin) AS begin avg(end) AS end by sessionId

thewho123
Explorer

Hi,
This creates a table with sessionId, count, begin, end columns. I needed the average of endF (minus) beginF from each object and calculate their average.

0 Karma

sundareshr
Legend

This should give you that...

your base search | rex max_match=0 "beginF=(?<begin>\d+\.?\d*),\sendF=(?<end>\d+\.?\d*)" | eval z=mvzip(begin, end) | mvexpand z | rex field=z "^(?<begin>[^,]+),(?<end>.*)$" | eval diff=end-begin | stats count avg(begin) AS begin avg(end) AS end avg(diff) as diff by sessionId
0 Karma

thewho123
Explorer

I am trying to calculate each pair separately. {beginF=1550652.855, endF=1550719.130001} and then get average of each calculated value
These will be timing values so (total beginF - total endF) will not work..

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...