Splunk Search

How to search with a fixed time span timechart everyday?

zacksoft
Contributor

I am trying to find my average response time of everyday events (not avg of all the events of that day , but the events from 10AM to 1PM) only for last 7 days.

sourcetype="super:access" host=xa20hlf**  | eval headers=split(_raw," ") | eval resp_time=mvindex(headers,10) | eval resptime_time_seconds=resp_time*0.001| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTime
0 Karma
1 Solution

DalJeanis
Legend

Try this...

sourcetype="super:access" host=xa20hlf**  
| eval Hour=strftime(_time,"%H")
| where Hour>=10 AND Hour<13
| eval headers=split(_raw," ") 
| eval resp_time=mvindex(headers,10) 
| eval resptime_time_seconds=resp_time*0.001
| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTim

View solution in original post

horsefez
Motivator

Hi @zacksoft,

how about this:

sourcetype="super:access" host=xa20hlf** earliest=-7d@d latest=now (date_hour=10 OR date_hour=11 OR date_hour=12 OR date_hour=13) | eval headers=split(_raw," ") | eval resp_time=mvindex(headers,10) | eval resptime_time_seconds=resp_time*0.001| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTime

0 Karma

zacksoft
Contributor

I wanna change the latest = now to latest = (a fix time of day/week, that I choose like this wednesday 6pm) . Also can we exclude weekends?
When we give span=1d, what exactly is the duration of 1d in clockwise?

0 Karma

DalJeanis
Legend

Try this...

sourcetype="super:access" host=xa20hlf**  
| eval Hour=strftime(_time,"%H")
| where Hour>=10 AND Hour<13
| eval headers=split(_raw," ") 
| eval resp_time=mvindex(headers,10) 
| eval resptime_time_seconds=resp_time*0.001
| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTim

twinspop
Influencer

Dal: In my admittedly limited testing, I found it ~ 8% faster to filter on hour after the timechart. Trim the first eval and the first where, and after timechart add: | where tonumber(strftime(_time,"%H"))>=10 and tonumber(strftime(_time,"%H"))<13. My test was a simple count on _internal.

DalJeanis
Legend

@twinspop - you can't filter on hour after the timechart aggregates to span=1d ... so it would not work unless you change the timechart to span=1h and then run it again through timechart to aggregate it up to the day level... and then you are averaging the averages rather than the actual events. If you have an idea that you think will work, please go ahead and write it up as an answer. The more, the merrier!

twinspop
Influencer

Shoot man, you're totally right. My bad.

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...