How to add an average transaction duration overlay to a timechart with a split by clause?

[bradj013]

Splunk=6.1.4

My search looks like this:
| transaction TransID keepevicted=true | search eventcount=2 | timechart limit=0 span=1m max(duration) by host

Trying to add an average transaction duration overlay (global not by host) to the chart by adding to the search term: "| eventstats avg(max(duration)) as average | eval average=round(average,0)" and selecting "average" as the overlay value. The overlay is blank.

[martin_mueller · Accepted solution]

Your search is shooting blanks because there is no field duration in the results of your timechart. Try this:

... | timechart ... by host | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=_total | eval average = _total / _count

Configure the chart to overlay the field average.

[martin_mueller]

Heh. A little walk-through: You have fields named after your hosts, so you can't access one field called duration. Calculating an average is the same as calculating a sum and a count, then dividing the two. That's what I'm doing here:

• set up the counter
• count how many fields (hosts) you have
• sum up the values
• divide the two

All that is done with _fieldnames starting with an underscore, so there's no need to hide them using fields - _count _total because the chart doesn't see them anyway... yeah, I'm lazy.

[landen99]

Laziness in success drives efficiency.

[bradj013]

Thanks for the quick response. Not sure how this works, but it does.