Splunk Search

## Custom Query

New Member

I look for all strings as shown below. I need to calculate the number of such calls (8 in this case) and the average of (3, 5, 8, 4, 6, 12, 4, 15). It would show in graph as number of calls and average time. Can some help on this please?

stat: Encoder return in 3 ms
stat: Encoder return in 5 ms
stat: Encoder return in 8 ms
stat: Encoder return in 4 ms
stat: Encoder return in 6 ms
stat: Encoder return in 12 ms
stat: Encoder return in 4 ms
stat: Encoder return in 15 ms

Tags (1)
1 Solution
Splunk Employee

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768"
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg


That will render something like this:

Splunk Employee

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768"
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg


That will render something like this:

Legend

This might do it -

Data as a table

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| bucket span=1h _time
| stats count avg(ms) as AvgMs by _time


Graph of count

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h count


Graph of average ms

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h avg(ms) as AvgMs

Get Updates on the Splunk Community!

The Notification Team is migrating our email service provider from Postmark to AWS Simple Email Service (SES) ...

#### Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

#### Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...