Splunk Search
Highlighted

How to add an average transaction duration overlay to a timechart with a split by clause?

Explorer

Splunk=6.1.4

My search looks like this:
| transaction TransID keepevicted=true | search eventcount=2 | timechart limit=0 span=1m max(duration) by host

Trying to add an average transaction duration overlay (global not by host) to the chart by adding to the search term: "| eventstats avg(max(duration)) as average | eval average=round(average,0)" and selecting "average" as the overlay value. The overlay is blank.

0 Karma
Highlighted

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

SplunkTrust
SplunkTrust

Your search is shooting blanks because there is no field duration in the results of your timechart. Try this:

... | timechart ... by host | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=_total | eval average = _total / _count

Configure the chart to overlay the field average.

View solution in original post

Highlighted

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

Explorer

Thanks for the quick response. Not sure how this works, but it does.

Highlighted

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

SplunkTrust
SplunkTrust

Heh. A little walk-through: You have fields named after your hosts, so you can't access one field called duration. Calculating an average is the same as calculating a sum and a count, then dividing the two. That's what I'm doing here:

  • set up the counter
  • count how many fields (hosts) you have
  • sum up the values
  • divide the two

All that is done with _fieldnames starting with an underscore, so there's no need to hide them using fields - _count _total because the chart doesn't see them anyway... yeah, I'm lazy.

Highlighted

Re: How to add an average transaction duration overlay to a timechart with a split by clause?

Motivator

Laziness in success drives efficiency.