Finding all instances of a field greater than the avg of that field during a 15 minute span

[kultar]

Hi All,

I have a field "TotalResponse" which is the total response time for a web request. I'm attempting to determine the following:
1. What the average "TotalResponse" is over a 15 minute span
2. Return any result where "TotalResponse" is greater than the average
3. Total % of responses that were greater than the average

I'm having a bit of a tough time figuring out part 2, hopefully someone can help?

Cheers
K

[sideview · Accepted solution]

Give this a shot:

<your search here> | eventstats count as globalCount avg(TotalResponse) as globalAvg | where TotalResponse > globalAvg | stats count as greaterThanAverageCount last(globalAvg) as globalAvg last(globalCount) as globalCount | eval percent = 100 * greaterThanAverageCount / globalCount | table globalAvg percent

The Eventstats command allows you to do anything you can do in stats, but paint the aggregate statistical results about the whole set back onto each of the original incoming rows. Basically whenever you have a problem that feels like you need to make "two passes" through the data, you should look at eventstats, or its streaming cousin, streamstats.

[kultar]

Thanks very much! That was super helpful! Plus, I learned something new!

[sideview]

Nature abhors any search language question left unanswered for more than 5 minutes!

[sdaniels]

I'm just not quick enough, thanks sideview