How to write a search to calculate the average length of sessions by time?

[dgravesa1]

Hi New to Splunk:

Trying to calculate average session lengths ( in time ) for sessions that have failed. And one for sessions that are successful. Below is what i have put together:

index=CCTV streaming_realm=* SessionFailed | bucket span=1m _time | dedup device_id, requested_deliverable | search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duration_Sec)

[somesoni2]

Try this

index=CCTV streaming_realm=* SessionFailed | stats range(_time) as duration by SessionID | stats avg(duration) as Avg_Session_Duration_Sec

OR

index=CCTV streaming_realm=* SessionFailed | transaction SessionID | stats avg(duration) as Avg_Session_Duration_Sec