Splunk Search

How to search average response + total application count for last 6 months with span of 1 month

ngaviran
New Member

I am trying to query and not able to get the output , only i am getting host names, Avg response , count , but need Span of 1 month also in the output .

below is the search queary where i expecting month on month column output also ...
sourcetype="ats_request" host!=dc* | stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host

Tags (1)
0 Karma

kmaron
Motivator

Try this

sourcetype="ats_request" host!=dc* 
| bucket _time span=1mon
| stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host _time
0 Karma

ngaviran
New Member

Thanks a lot, it works for me @kmaron

0 Karma

kmaron
Motivator

Since it worked for you please accept my answer so others know your question was answered.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...