Splunk Search

How to group by and find stats on every X number of events instead of time or bins?

jwf
New Member

Hello.

I want to get a statistic for values of every X number of non-overlapping events. For example, for events with time and value fields, the average of the values for every 2 fields is

(1-1)
(2-1) --> (1+1)/2=1

(3-2)
(4-3) --> (2+3)/2=2.5
(5-1)
(6-4) --> (1+4)/2=2.5
(7-5)
(8-5) --> (5+5)/2=5
(9-7)

To end up with a chart (time-avg)
(2-->1)
(4-->2.5)
(6-->2.5)
(8-->5)

I looked at bucket (bins, minspan), timechart, streamstats. but couldn't figure it out. Thanks for your help.

0 Karma

gfuente
Motivator

Hello Try this:

| bucket _raw span=2

Regards

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...