My search looks like this:
| transaction TransID keepevicted=true | search eventcount=2 | timechart limit=0 span=1m max(duration) by host
Trying to add an average transaction duration overlay (global not by host) to the chart by adding to the search term: "| eventstats avg(max(duration)) as average | eval average=round(average,0)" and selecting "average" as the overlay value. The overlay is blank.
Your search is shooting blanks because there is no field
duration in the results of your
timechart. Try this:
... | timechart ... by host | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=_total | eval average = _total / _count
Configure the chart to overlay the field
Thanks for the quick response. Not sure how this works, but it does.
Heh. A little walk-through: You have fields named after your hosts, so you can't access one field called
duration. Calculating an average is the same as calculating a sum and a count, then dividing the two. That's what I'm doing here:
All that is done with
_fieldnames starting with an underscore, so there's no need to hide them using
fields - _count _total because the chart doesn't see them anyway... yeah, I'm lazy.