How i get Avg, Max, Min for every 5 min interval one by one in row?

[nitesh218ss]

I create query which give total Average, min and max value in one row i need the result come in every 5 minuet Avg, Max, Min in one by one in row Like
Time_diff AVg Max Min
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:10:00.00 - 07:14:59.999 1.7 1.9 1.4

My Query is
<code start>
index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ] |eventstats latest(time1) as lat,earliest(time2) as ear| eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 |stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min

<code end>
Please help in this problem

[jeffland · Accepted solution]

If I understood you correctly, you want to use bucket on Time_diff (docs here).

[nitesh218ss]

....|bucket _time span=5m I use this in many place but not effect
any small example .which i understand and learn easly

[jeffland]

Using it on _time won't help you if you are looking to bucket TimeDiff in five minute spans. You should probably go with something like

| bucket TimeDiff span=5m

[nitesh218ss]

Thankyou very much

[nitesh218ss]

hi i got Thanku very much for help me
my query is:

index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ] | eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 | bucket _time span=5m |stats avg(TimeDiff) min(TimeDiff),max(TimeDiff) by _time

this quey working for every 5 min
but only one problem is date are not present in log file so splunk take auto date so the output is change base on date differ

[nitesh218ss]

i use this also but they given 0 output because.
TimeDiff is only difference between request time and response time of transaction in other word TimeDiff is difference between sub query and main query but i want base on main time that is time1 or time2
It is possible by bucket
i try bucket time1 span=5m, bucket time2 span=5m but not any effect i got only one row
not different row of every 5 min

[jeffland]

Using bucket on the initial time will not help you at all, you need to do that on the data of the resulting table (because you want the resulting table to be grouped by five minute intervals). Have you tried adding by TimeDiff at the end of your stats?

[nitesh218ss]

I try but they give base on every Average of Time_diff for particular Time_diff
but TimeDiff is only time1-time2
time1 and time2 is important
TimeDiff is time take per trancation that is only in some milisecond to second
I need every 5 min of time1 they calculate Avg of TimeDiff

TimePer5_min AVg(Time_diff) Max(Time_diff) Min(Time_diff)
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:10:00.00 - 07:14:59.999 1.7 1.9 1.4

I try from 1 and half day but i not got solution

[jeffland]

You need to bucket before your stats.