Splunk Search

How to get an avg field result in a stats values command

egrignon
Explorer

Hello Splunk Users

I m trying to get an average response time per IP for a few sites I m monitoring.

  • | stats values(remote_ip) avg(time) by url

This gives me the a list of URL with all ip values found for it. However, it is showing the avg time for all IP instead of the avg time for every IP.

The only solution I found was to use:

  • | stats avg(time) by url, remote_ip

However, that makes the report looks heavy and not very friendly since the same url are showing multiple times.

Is there any way to get the avg time by remote_ip, which is itself by url without having duplicates entries in the output?

Thank you in advance,

EG

Tags (2)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

I am not sure this is what you're looking for but if you just want a report with urls then a list of ips and a list of the times per IP try this:

| stats avg(time) as "time_per_ip" by url, remote_ip | stats list(remote_ip) as "IPs" list(time_per_ip) as "time_per_ip" by url | table url IPs times_per_ip

This will give you a consolidated table.

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

I am not sure this is what you're looking for but if you just want a report with urls then a list of ips and a list of the times per IP try this:

| stats avg(time) as "time_per_ip" by url, remote_ip | stats list(remote_ip) as "IPs" list(time_per_ip) as "time_per_ip" by url | table url IPs times_per_ip

This will give you a consolidated table.

egrignon
Explorer

Perfect, that did the trick.

Thank you.

EG

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...