Splunk Search

## Custom Query

New Member

I look for all strings as shown below. I need to calculate the number of such calls (8 in this case) and the average of (3, 5, 8, 4, 6, 12, 4, 15). It would show in graph as number of calls and average time. Can some help on this please?

stat: Encoder return in 3 ms
stat: Encoder return in 5 ms
stat: Encoder return in 8 ms
stat: Encoder return in 4 ms
stat: Encoder return in 6 ms
stat: Encoder return in 12 ms
stat: Encoder return in 4 ms
stat: Encoder return in 15 ms

Tags (1)
1 Solution
Splunk Employee

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768"
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg


That will render something like this:

Splunk Employee

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768"
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg


That will render something like this:

Legend

This might do it -

Data as a table

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| bucket span=1h _time
| stats count avg(ms) as AvgMs by _time


Graph of count

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h count


Graph of average ms

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h avg(ms) as AvgMs

Get Updates on the Splunk Community!

#### There’s a New Certification in Town: Splunk Certified Cybersecurity Defense Engineer

Calling all cybersecurity professionals! The latest addition to the Splunk certification family is here, and ...

#### Enterprise Security Content Update (ESCU) | New Releases

In July, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

#### Unlock the Power of Your Splunk Data

REGISTER NOW!Tech Talk: Security EditionWednesday, August 28, 2024  |  11AM PT / 2PM ETIt’s time to accelerate ...