Splunk Search

Combining stats output with eval

brutecat
Path Finder

Some advice on something I would have thought to be easy.

I have a field called Elapsed. I want to calculate the number of events in a window of two hours, divide this count by 7200 (the number of seconds in 2 hours) and multiply this by the average value of Elapsed divided by 1000 over this two hours. I then want to send this evaluated result to a timechart. Here is my current search:

index=ediinter Elapsed>0 | bucket _time span=2h | stats avg(Elapsed) as Residence, count as Total |  eval queue=((Total/7200)*(Residence/1000)) |  timechart span=2h first(queue) as Queue

but this produces no results

What am I filtering out?

Thanks,

Stan

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

timechart requires _time.

| stats avg(Elapsed) as Residence, count as Total | ->fields:Residence、Total
↓Is this a for good?
| stats avg(Elapsed) as Residence, count as Total by _time|

View solution in original post

HiroshiSatoh
Champion

timechart requires _time.

| stats avg(Elapsed) as Residence, count as Total | ->fields:Residence、Total
↓Is this a for good?
| stats avg(Elapsed) as Residence, count as Total by _time|

brutecat
Path Finder

Hi HiroshiSatoh,

Great. Thanks very much. I had assumed this was the default.

Regards,

Stan

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...