Fellow Splunkers, I have a chart that displays my Apache processing times as such
Seconds count
0 191952
1 3494
2 408
3- 5 3429
5- 10 277
10- 20 294
20- 60 95
60-120 13
120-300 23
300-600 3
The search command is a simple
index="log_index" | eval LatencyRanges=case(seconds=0, "0 sec", seconds=1, "1 sec", etc., etc.) | stats count by LatencyRanges
What can I use after this to display the Average Second for the Total count as my last field?
Any feedback is greatly appreciated. Thanks.
for anyone interested in using a search similar to mine for getting avg response time.
...| eval seconds=spent*1.0e-6 | eventstats avg(seconds) AS Avg_Response_time_in_sec | eval Avg_Response_time_in_sec=round(Avg_Response_time_in_sec, 0) | chart count AS #Requests by Avg_Response_time_in_sec
So it take processing time in microseconds and converts to seconds, does an average of the total count of seconds and puts into the Avg_Response_time_in_sec field, then charts it out...
... | eventstats avg(count) as avg_count
Thanks for replying. I finally got around to playing with this one. I tweaked it a little but I got the concept.