How to stats count by app name , and avg count per minute by app name together in one query

[sivaranjani]

index=abc cf_space_name=prod-ad0000123 cf_app_name IN (RED,Blue,Green) "Initiating " OR "Protobuf message received" OR "Event Qualification Determined"
| bucket _time span=1m
| stats
count(eval(cf_app_name == "RED)) as RedVolume
count(eval(cf_app_name == "blue")) as BlueVolume
count(eval(cf_app_name == "Green")) as GreenVolume
avg(GreenVolume) as AvgGVolume
| eval estimate = (RED + Blue - Green) / AvgGVolume

[gcusello]

Hi @sivaranjani ,

let me understand:

you want to calculate the average per minute in a period and then display the count and the average per minute for each app, is it correct?

if this is your requirement, please, try something like this:

index=abc cf_space_name=prod-ad0000123 cf_app_name IN (RED,Blue,Green) "Initiating " OR "Protobuf message received" OR "Event Qualification Determined"
| bucket _time span=1m
| stats
     count(eval(cf_app_name == "RED)) AS RedVolume_by_min
     count(eval(cf_app_name == "blue")) AS BlueVolume_by_min
     count(eval(cf_app_name == "Green")) AS GreenVolume_by_min
     avg(GreenVolume) as AvgGVolume
     BY _time
| stats
     sum(RedVolume_by_min) AS RedVolume
     sum(BlueVolume_by_min) AS BlueVolume
     sum(GreenVolume_by_min) AS GreenVolume
     avg(RedVolume_by_min) AS RedVolume_avg
     avg(BlueVolume_by_min) AS BlueVolume_avg
     avg(BlueVolume_by_min) AS BlueVolume_avg
     BY _time
| eval 
     estimate = (RED + Blue - Green) / AvgGVolume

Ciao.

Giuseppe

[sivaranjani]

Thanks this is perfect. Exactly what i needed. 

[gcusello]

Hi @sivaranjani ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[yuanliu · Accepted solution]

This is not a question, is it?  Here are some basics of asking an answerable question.

1. Illustrate data in text format (anonymize as needed) - be it raw events, extracted fields, or output from a preceding search.  Illustrate or explain any characteristics that is perhaps helping or preventing you from reaching desired results.
2. Illustrate desired output (in text format unless the question is about visualization) corresponding to illustrated data.
3. Explain the logical connection between illustrated data and desired output, all without SPL.
4. If you already tried some SPL, also illustrate actual output from that illustrated data, then explain how actual output differs from desired output if that is not painfully obvious.