Splunk Search

How to group by and find stats on every X number of events instead of time or bins?

jwf
New Member

Hello.

I want to get a statistic for values of every X number of non-overlapping events. For example, for events with time and value fields, the average of the values for every 2 fields is

(1-1)
(2-1) --> (1+1)/2=1

(3-2)
(4-3) --> (2+3)/2=2.5
(5-1)
(6-4) --> (1+4)/2=2.5
(7-5)
(8-5) --> (5+5)/2=5
(9-7)

To end up with a chart (time-avg)
(2-->1)
(4-->2.5)
(6-->2.5)
(8-->5)

I looked at bucket (bins, minspan), timechart, streamstats. but couldn't figure it out. Thanks for your help.

0 Karma

gfuente
Motivator

Hello Try this:

| bucket _raw span=2

Regards

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...