Splunk Search

Getting count and averages in same search

Contributor

Hi,

I think this must be easy.. but I can't wrap my head around how to get this done... I want to gather multiple stats for a single query. Essentially, I want to gather the count and avg thruput for webpages from my iis logs...Essentially, something like this..

Page1.html count=10, avgtime=20

Page2.html count=17, avgtime=30

Any suggestions?

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

if avgtime represents the average of some field like say response_time, and if Page1.html and Page2.html are a field called filename, then you're looking at a simple stats clause of

| stats count avg(response_time) by filename

View solution in original post

SplunkTrust
SplunkTrust

if avgtime represents the average of some field like say response_time, and if Page1.html and Page2.html are a field called filename, then you're looking at a simple stats clause of

| stats count avg(response_time) by filename

View solution in original post

Contributor

:)... Cannot believe that I couldn't see that.. Thanks nick!

0 Karma