Splunk Search

How to get Stats from Search and Average?

jpsquires
New Member

This is probably quite simple and I am missing something..
i am using this search.

index=sxxx sourcetype=sxxx host=xyz  source="C:\\mydata" |Dedup _time|table _time, host, username, SimulatorProcess, ProcessTime

I have the following search result

08/19/2019 16:44:34,136Z INFO  user[XXXX] tid[ 1] [(null)]: ProcessSimulationResults took: 1.1204099 seconds

i did a field extraction to get the username, what the process is and the time. I would like to put these in a table and average them out. Search has 4 results but when i put into a table i get many null results.
what is the best way to display and average these out. Would also like to have a single display of the averages over day/week/month.

thanks!

Tags (2)
0 Karma
1 Solution

solarboyz1
Builder

Here's how to get the average processTime by user, host, and SimulatorProcess:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  stats  avg(ProcessTime) as avgProcessTime  by host, username, SimulatorProcess
| table host, username, SimulatorProcess, avgProcessTime

You can also do this over time:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  timechart avg(ProcessTime) as avgProcessTime, values(username) as users, values(host) as hosts  by SimulatorProcess

View solution in original post

0 Karma

solarboyz1
Builder

Here's how to get the average processTime by user, host, and SimulatorProcess:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  stats  avg(ProcessTime) as avgProcessTime  by host, username, SimulatorProcess
| table host, username, SimulatorProcess, avgProcessTime

You can also do this over time:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  timechart avg(ProcessTime) as avgProcessTime, values(username) as users, values(host) as hosts  by SimulatorProcess
0 Karma

jpsquires
New Member

Excellent.. Thank you for the assist.

0 Karma

jpsquires
New Member

Stats count by _Time, host, username, SimulatorProcess, ProcessTime gives me a good chart. Now to average

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...