New to Splunk, need some help.
I would like to build a timechart that does the following:
I have the average response time taken care of I think:
| timechart avg(time_taken) span=1h
Any ideas?
We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:
* | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)
The subsearch approach looks something like this, but it will perform (at least) twice as poorly as csharp's solution -- mainly due to having to run the main search twice. And, it's not been proven to be any more accurate.
_main_search_terms_ | timechart avg(time_taken) as avg
| appendcols
[ _main_search_terms_again_
| stats perc90(gers_SQL_lapse) as p90temp
| fields p90temp
]
| eventstats first(p90temp) as p90
| fields - p90temp
Unless you can find a demonstrable difference in accuracy, use csharp's solution. We'd be interested to hear results with your data if there is a substantial difference in the results.
We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:
* | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)