Splunk Search

## Custom Query

New Member

I look for all strings as shown below. I need to calculate the number of such calls (8 in this case) and the average of (3, 5, 8, 4, 6, 12, 4, 15). It would show in graph as number of calls and average time. Can some help on this please?

stat: Encoder return in 3 ms
stat: Encoder return in 5 ms
stat: Encoder return in 8 ms
stat: Encoder return in 4 ms
stat: Encoder return in 6 ms
stat: Encoder return in 12 ms
stat: Encoder return in 4 ms
stat: Encoder return in 15 ms

Tags (1)
1 Solution
Splunk Employee

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768"
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg


That will render something like this:

Splunk Employee

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768"
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg


That will render something like this:

Legend

This might do it -

Data as a table

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| bucket span=1h _time
| stats count avg(ms) as AvgMs by _time


Graph of count

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h count


Graph of average ms

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h avg(ms) as AvgMs

Get Updates on the Splunk Community!

#### Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

#### Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

#### Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...