Splunk Search
Highlighted

Is it possible, within the same search, to find the count of events where the transaction duration is greater than and less than the average?

New Member

I am trying to get the count of events where the transaction duration is above the average duration and below the average duration.

below is my search to find out the count of events above the average transaction duration:

index=whatever*  sourcetype="Source"  "COMPONENTNAME=X" AND "EVENT=Received"|eval receivedtime=SERVER_TIME |join type=inner ORDERNUMBER max=0[search index=tas_prod  sourcetype="TAS:FUSION:ProdSupport:PRD:AuditDB"  "COMPONENTNAME=Y" AND "EVENT=Delivered"|eval deliveredTime=SERVER_TIME ]|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt

is it possible to get the count of transactions with diff < Avg in the same search? like:

searchStatement|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt | where diff < Avg |stats count as Lsr

please let me know if i can combine the count without using the same search statement another time to find the count for less than average

0 Karma
Highlighted

Re: Is it possible, within the same search, to find the count of events where the transaction duration is greater than and less than the average?

Legend

You could try this

.... | stats count(eval(diff>Avg)) as Grt count(eval(diff<Avg)) as Lsr

View solution in original post

0 Karma
Highlighted

Re: Is it possible, within the same search, to find the count of events where the transaction duration is greater than and less than the average?

New Member

thanks this worked.

0 Karma