Splunk Search

How to calculate average for the data which will get changed based on time interval ?

georgear7
Communicator

I have below kind of data.

App Name Status
App1                0
App2               0
App3               0
App4               0
App5               0
App6               1
App7               0
App8               0
App9               0
App10            0


0 - Success
1 - Failure

Assign,
0 as 100%
1 as 0%

Here status value will get updated every 5 mins. So my requirement is to calculate the average from the starting time of day till present time by app. In this table, success percentage will be 90%. Similarly query should work if i want to calculate the average time after n'th update.

Next thing is i want to keep current status in one variable. and my final output should be having 2 data, one is current status and other one is Average data.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

| makeresults | eval _raw="App Name Status
App1                0
App2               0
App3               0
App4               0
App5               0
App6               1
App7               0
App8               0
App9               0
App10            0" | multikv forceheader=1
```Above is just for test data```
| stats sum(Status) as status,count, latest(Status) as Current by App
| eval Average= 100-((status*100)/count), Current=100-(Current*100)
| table App, Current, Average
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here's a run-anywhere search for the first set of requirements.

| makeresults | eval _raw="App Name Status
App1                0
App2               0
App3               0
App4               0
App5               0
App6               1
App7               0
App8               0
App9               0
App10            0" | multikv forceheader=1
``` Above just defines test data```
| stats sum(Status) as status,count
| eval SuccessRate= 100-((status*100)/count)
| table SuccessRate

I don't understand the remaining requirements.  What is the average of?  Over what time?

---
If this reply helps you, Karma would be appreciated.
0 Karma

georgear7
Communicator

@richgalloway Thanks for your reply.

As i mentioned, Status of each App will get updated every 5 mins, It's live data.

For eg, if you take App1, starting from day...Means from 12.00 AM..

At 12.00 AM, first status will be updated for all the apps. then at 00.05, 00.10, 00.15........It goes on

Finally what my requirement is, to calculate the average and current status of each app separately by assigning 100 to success (ie. 0) and 0 to failure(ie. 1). I need this day wise, so next day it should start from 12 AM again.

If i run my query at anytime in a day, it should give me current status and average status for each app like below.

The final output table should be,

 

AppCurrent StatusAverage Status
App110090%
App2100100%
App3080%
App4100100%
App5100100%

 

Hope this clarifies you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

| makeresults | eval _raw="App Name Status
App1                0
App2               0
App3               0
App4               0
App5               0
App6               1
App7               0
App8               0
App9               0
App10            0" | multikv forceheader=1
```Above is just for test data```
| stats sum(Status) as status,count, latest(Status) as Current by App
| eval Average= 100-((status*100)/count), Current=100-(Current*100)
| table App, Current, Average
---
If this reply helps you, Karma would be appreciated.

georgear7
Communicator
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...