How to use timechart command to calculate the average of a field?

[chengyu]

My raw data:

Feb  7 18:18:23 impact 1 Gbps/137.54 Kpps, importance 2...
Feb  7 18:18:23 impact 3600 Mbps/137.54 Kpps, importance 2...

I want use timechart search command calculate avg(1Gbps & 3600Mbps) by week or month. Now i use rex to extract field 1G and 3600Mbps values but the field name is same. i wish to change 3600Mbps to Gbps then run timechart avg(field). What should i do? Thanks.

[chengyu · Accepted solution]

Hi Sir, data is 1 Gbps/137.54 Kpps or 3600 Mbps/137.54 Kpps, i want calculate 1Gbps & 3600 Mbps avg value, not Kpps value. So i can use rex extract field capture 1 and 3600 value and call field name "bandwidth", but 3600 need transfer to gigabyte, finally use splunk command "timechart sapn=1mon avg(bandwidth)"

[mpreddy]

If you were able to extract field  bandwidth 1 and 3600 then extract or split another field called type  Gbps and Mbps and use If condition type = Gbps  then bandwidth/1000 else bandwidth and then use timechart for average.

[chengyu]

myserarch ... |table bandwidth,_time | rex field=bandwidth "^(?P\d+.\d+)\s(?P\w+)$" | eval Unit=case(Unit="Gbps",1024,true(),1) | eval InGbps=(Value*Unit)/1024 |eval InGbps=round(InGbps,2) | timechart span=1d max(InGbps) as MaxGbps avg(InGbps) as AvgGbps

extract fields :
1.04 Gbps
384.05 Mbps
5.01 Gbps
...

[mpreddy]

try like this:

base query |rex "impact\s(?<bandwidth>.*)/(?<mbps>.\d+.\d+)"  |timechart span=1mon avg(mbps) as avg by bandwidth

[somesoni2]

Can you share your current search that you've so far?