Splunk Search

Getting count and averages in same search

richnavis
Contributor

Hi,

I think this must be easy.. but I can't wrap my head around how to get this done... I want to gather multiple stats for a single query. Essentially, I want to gather the count and avg thruput for webpages from my iis logs...Essentially, something like this..

Page1.html count=10, avgtime=20

Page2.html count=17, avgtime=30

Any suggestions?

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

if avgtime represents the average of some field like say response_time, and if Page1.html and Page2.html are a field called filename, then you're looking at a simple stats clause of

| stats count avg(response_time) by filename

View solution in original post

sideview
SplunkTrust
SplunkTrust

if avgtime represents the average of some field like say response_time, and if Page1.html and Page2.html are a field called filename, then you're looking at a simple stats clause of

| stats count avg(response_time) by filename

richnavis
Contributor

:)... Cannot believe that I couldn't see that.. Thanks nick!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...