Splunk Search

How to get Stats from Search and Average?

jpsquires
New Member

This is probably quite simple and I am missing something..
i am using this search.

index=sxxx sourcetype=sxxx host=xyz  source="C:\\mydata" |Dedup _time|table _time, host, username, SimulatorProcess, ProcessTime

I have the following search result

08/19/2019 16:44:34,136Z INFO  user[XXXX] tid[ 1] [(null)]: ProcessSimulationResults took: 1.1204099 seconds

i did a field extraction to get the username, what the process is and the time. I would like to put these in a table and average them out. Search has 4 results but when i put into a table i get many null results.
what is the best way to display and average these out. Would also like to have a single display of the averages over day/week/month.

thanks!

Tags (2)
0 Karma
1 Solution

solarboyz1
Builder

Here's how to get the average processTime by user, host, and SimulatorProcess:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  stats  avg(ProcessTime) as avgProcessTime  by host, username, SimulatorProcess
| table host, username, SimulatorProcess, avgProcessTime

You can also do this over time:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  timechart avg(ProcessTime) as avgProcessTime, values(username) as users, values(host) as hosts  by SimulatorProcess

View solution in original post

0 Karma

solarboyz1
Builder

Here's how to get the average processTime by user, host, and SimulatorProcess:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  stats  avg(ProcessTime) as avgProcessTime  by host, username, SimulatorProcess
| table host, username, SimulatorProcess, avgProcessTime

You can also do this over time:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  timechart avg(ProcessTime) as avgProcessTime, values(username) as users, values(host) as hosts  by SimulatorProcess
0 Karma

jpsquires
New Member

Excellent.. Thank you for the assist.

0 Karma

jpsquires
New Member

Stats count by _Time, host, username, SimulatorProcess, ProcessTime gives me a good chart. Now to average

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...