Splunk Search

How to get Stats from Search and Average?

jpsquires
New Member

This is probably quite simple and I am missing something..
i am using this search.

index=sxxx sourcetype=sxxx host=xyz  source="C:\\mydata" |Dedup _time|table _time, host, username, SimulatorProcess, ProcessTime

I have the following search result

08/19/2019 16:44:34,136Z INFO  user[XXXX] tid[ 1] [(null)]: ProcessSimulationResults took: 1.1204099 seconds

i did a field extraction to get the username, what the process is and the time. I would like to put these in a table and average them out. Search has 4 results but when i put into a table i get many null results.
what is the best way to display and average these out. Would also like to have a single display of the averages over day/week/month.

thanks!

Tags (2)
0 Karma
1 Solution

solarboyz1
Builder

Here's how to get the average processTime by user, host, and SimulatorProcess:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  stats  avg(ProcessTime) as avgProcessTime  by host, username, SimulatorProcess
| table host, username, SimulatorProcess, avgProcessTime

You can also do this over time:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  timechart avg(ProcessTime) as avgProcessTime, values(username) as users, values(host) as hosts  by SimulatorProcess

View solution in original post

0 Karma

solarboyz1
Builder

Here's how to get the average processTime by user, host, and SimulatorProcess:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  stats  avg(ProcessTime) as avgProcessTime  by host, username, SimulatorProcess
| table host, username, SimulatorProcess, avgProcessTime

You can also do this over time:

index=ixxx sourcetype=sxxx host=xyz source=xxx 
|  timechart avg(ProcessTime) as avgProcessTime, values(username) as users, values(host) as hosts  by SimulatorProcess
0 Karma

jpsquires
New Member

Excellent.. Thank you for the assist.

0 Karma

jpsquires
New Member

Stats count by _Time, host, username, SimulatorProcess, ProcessTime gives me a good chart. Now to average

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...