Splunk Search

Getting average times for user defined categories

RVDowning
Contributor

stats count as #PlanOpen,
count(eval(NumRows < 50)) as SmallPlans ,
count(eval(NumRows>=50 AND NumRows <200)) as MediumPlans,
count(eval(NumRows >=200)) as LargePlans

With a query such as above and a field SecsElapsed in each row, is there a way to get the average of that field for each category, namely SmallPlans, MediumPlans and LargePlans?

Tags (2)
0 Karma

RVDowning
Contributor

Have no idea if that is what you meant or not.

0 Karma

cpeteman
Contributor

Can you change this so the code is formatted please? Thanks 🙂

0 Karma

RVDowning
Contributor

Ok, I think I have this. I was just in syntax hell.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...