Splunk Search

How write a search to place averages from different time ranges on the same column chart?

Bliide
Path Finder

I am trying to place values with different time ranges on the same column chart. I have 3 values that I would like to place on the same chart for comparison. I would like the last value, the 24 hour average and the 7 day average of that value on the same chart. I cannot find how to configure the search to create the values. Is this something that I need to use an eval for?

Tags (4)
0 Karma

stephanefotso
Motivator

Hello! My proposition is not optimal, but it can help you as a start point. Let suppose you are working with the _internal index and you want the last sourcetype, the 24 hour average and the 7 day average of that value on the same chart. Here you go!

index=_internal sourcetype=*|stats first(sourcetype) count as countvalue|join [search index=_internal sourcetype=*|bucket  _time span=1d|stats count as total24h by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg24h=countfirst/total24h|table avg24h]|join[search index=_internal sourcetype=*|bucket  _time span=7d|stats count as total7day by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg7day=countfirst/total7day|table avg7day]|table countvalue avg24h avg7day

dmaslin_splunk's link can help you uptimise that query,

SGF
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...