Splunk Search
Highlighted

Does timechart span have an effect on computation of avg(duration)?

Path Finder

Using Splunk 4.1.7


[searchstring...] earliest=09/23/2012:09:00:00 latest=09/23/2012:10:00:00 AccountID | transaction AccountID startsWith="Transaction Begin" endswith="Transaction End" keepevicted=false | timechart avg(duration) span=10m

As I increase the value for span, the avg(duration) seems to increase.

Is this the way it is supposed to work?

0 Karma
Highlighted

Re: Does timechart span have an effect on computation of avg(duration)?

Legend

If you increase the span and that has the effect that events with higher values for duration are then included in the span, then yes. Other than that, the span parameter has no effect in itself on whether the average goes up or down - the average is calculated simply in the classic way of taking the sum of all duration values in the events in a timespan and dividing that sum by the number of events in the timespan.

View solution in original post

Highlighted

Re: Does timechart span have an effect on computation of avg(duration)?

Path Finder

I looked closer at my raw logs, and noticed transactions that appear to span multiple hours that got included as I increased the span=, that was causing this behavior. Thanks!

0 Karma