I want to calculate the average time of being in a URL.
This SPL shows me the time spent in a URL, but NOT the average
index=fortigate | transaction url | table duration, url
This other SPL gives me the Total average. It is NOT by url
index=fortigate | transaction url | stats avg(duration) AS Avg_Session_Time
@rosho unfortunately I dont think this information is enough for correlating the duration in a URL. What is the event data/field which will determine login and logoff or something similar that URL is in use?
index=bigip host="F5-BOU-4K-A.entourage.intra" | transaction session_id | stats avg(duration) AS Avg_Session_time by Client_IP
This will do it. But I do not know how to put the average bytes_in for each clientip