Splunk Search

How to TimeChart for average function avg()?

DPOIRE
Path Finder

I have this search that is working and returning a average Delay value:

Search Command

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z")
| stats range(epoch_timestamp) as Delay by "logId"
| stats avg(Delay)

However, I want to display the daily averages in a timechart graph to see the performance evolution by day.
Tried the following based on research but It does not return Statistic or Vizualization values (just returning events):

Search Command

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z")
| stats range(epoch_timestamp) as Delay by "logId"
| bucket _time span=1d
| stats avg(Delay) as Performance by _time
Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval Performance=if(Performance == 0,null(),Performance)

ITWhisperer_0-1680016474944.png

 

View solution in original post

DPOIRE
Path Finder

Thanks, appears to partially work.
You provided the solution to my question.
However, I have this result now where Sunday is returning a zero value which is screwing up the results and trend.
How can I remove these from the results and graph?

DPOIRE_0-1680015199100.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Performance=if(Performance == 0,null(),Performance)

ITWhisperer_0-1680016474944.png

 

ITWhisperer
SplunkTrust
SplunkTrust

Try something by this

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z")
| stats range(epoch_timestamp) as Delay max(_time) as _time by "logId"
| bucket _time span=1d
| stats avg(Delay) as Performance by _time
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...