Splunk Search

How write a search to place averages from different time ranges on the same column chart?

Bliide
Path Finder

I am trying to place values with different time ranges on the same column chart. I have 3 values that I would like to place on the same chart for comparison. I would like the last value, the 24 hour average and the 7 day average of that value on the same chart. I cannot find how to configure the search to create the values. Is this something that I need to use an eval for?

Tags (4)
0 Karma

stephanefotso
Motivator

Hello! My proposition is not optimal, but it can help you as a start point. Let suppose you are working with the _internal index and you want the last sourcetype, the 24 hour average and the 7 day average of that value on the same chart. Here you go!

index=_internal sourcetype=*|stats first(sourcetype) count as countvalue|join [search index=_internal sourcetype=*|bucket  _time span=1d|stats count as total24h by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg24h=countfirst/total24h|table avg24h]|join[search index=_internal sourcetype=*|bucket  _time span=7d|stats count as total7day by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg7day=countfirst/total7day|table avg7day]|table countvalue avg24h avg7day

dmaslin_splunk's link can help you uptimise that query,

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!