Splunk Search

Getting average times for user defined categories

RVDowning
Contributor

stats count as #PlanOpen,
count(eval(NumRows < 50)) as SmallPlans ,
count(eval(NumRows>=50 AND NumRows <200)) as MediumPlans,
count(eval(NumRows >=200)) as LargePlans

With a query such as above and a field SecsElapsed in each row, is there a way to get the average of that field for each category, namely SmallPlans, MediumPlans and LargePlans?

Tags (2)
0 Karma

RVDowning
Contributor

Have no idea if that is what you meant or not.

0 Karma

cpeteman
Contributor

Can you change this so the code is formatted please? Thanks 🙂

0 Karma

RVDowning
Contributor

Ok, I think I have this. I was just in syntax hell.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...