Splunk Search

How to TimeChart for average function avg()?

DPOIRE
Path Finder

I have this search that is working and returning a average Delay value:

Search Command

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z")
| stats range(epoch_timestamp) as Delay by "logId"
| stats avg(Delay)

However, I want to display the daily averages in a timechart graph to see the performance evolution by day.
Tried the following based on research but It does not return Statistic or Vizualization values (just returning events):

Search Command

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z")
| stats range(epoch_timestamp) as Delay by "logId"
| bucket _time span=1d
| stats avg(Delay) as Performance by _time
Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval Performance=if(Performance == 0,null(),Performance)

ITWhisperer_0-1680016474944.png

 

View solution in original post

DPOIRE
Path Finder

Thanks, appears to partially work.
You provided the solution to my question.
However, I have this result now where Sunday is returning a zero value which is screwing up the results and trend.
How can I remove these from the results and graph?

DPOIRE_0-1680015199100.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Performance=if(Performance == 0,null(),Performance)

ITWhisperer_0-1680016474944.png

 

ITWhisperer
SplunkTrust
SplunkTrust

Try something by this

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z")
| stats range(epoch_timestamp) as Delay max(_time) as _time by "logId"
| bucket _time span=1d
| stats avg(Delay) as Performance by _time
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...