Splunk Search

How to find an Average Count over an hour in 5 min buckets

luckyman80
Path Finder

Hi Experts!
So I have an issue with GC cycles and we have this logged in splunk. I have used the below query which gives me the minor occurrences count overall (and works fine )

sourcetype=system*process*gc* "[GC pause" | rex field=source "print.prod..?(?.?)\/" | rex field=source "system_print(?.*?)_" | timechart span=5m limit=0 count(_raw) by instance

There are some parts of the day when some processes have large minor occurrences count and other times not so much. Im trying to find out and average count over and hour in 5 min buckets to see any large uptrends in count in general.

Any advice etc would be amazing.

Paul

0 Karma

luckyman80
Path Finder

Thanks Guys.. both of these work a treat!

0 Karma

dmarling
Builder

This will accomplish a average of the 5 minute bucket counts over whatever time frame you run it, but it won't include the zeros that get added by the timechart process into your average.

sourcetype=system*process*gc* "[GC pause" 
| rex field=source "print.prod..?(?.?)\/" 
| rex field=source "system_print(?.*?)_" 
| bin span=5m _time
| stats count by _time instance
| stats avg(count) as Average by instance

If you require those zeros provided by the timechart this will use that, but it will only work for a 60 minute time range of the search:

sourcetype=system*process*gc* "[GC pause" 
| rex field=source "print.prod..?(?.?)\/" 
| rex field=source "system_print(?.*?)_" 
| timechart span=5m limit=0 count(_raw) by instance partial=f
| transpose 0 column_name="instance" header_field=_time 
| addtotals
| eval Average=round(Total/11,6)
If this comment/answer was helpful, please up vote it. Thank you.

somesoni2
Revered Legend

Just add following to the end of your current search.

current search with timechart span=5m...
| timechart span=1h avg(*) as *

dmarling
Builder

Your solution is way simplier! I like it.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...