Splunk Search

How to find the average count of events for a timechart?

Path Finder

This sounds so easy but I can't seem to figure it out. Or maybe it's just ridiculous and there is a better way.

So I have

index=iis | timechart count by cs_uri_stem

And that's great, but what if I want to smooth out the timechart with an average? Or maybe just plot the deltas? Doing avg(count(_raw)) doesn't cut the mustard. Basically I want to try and stomp down the occasional spikes (which yes need attention in some circumstances) and just get an idea if hitcount is trending up. Any ideas?

Tags (3)
0 Karma

Champion

| timechart span=1h count as events | eventstats sum(events) as z| eventstats count(events) as y |eval average=round(z/y,2)|fields

Ultimately the average = sum/count

0 Karma

Champion

| timechart span=1h count as events | eventstats sum(events) as z| eventstats count(events) as y |eval average=round(z/y,2)|fields

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee

Have you looked at X11 ? Or trendline ? Trendline has exponential moving averages as well as weighted moving averages.

0 Karma