Splunk Search

Multi-column stats: average and count for a column

New Member

I am building a search to find the average amount of time an action takes:

sourcetype="timelog" | stats avg(request_duration) by requested_file

However, I would also like to see the number of hits represented in that average which I would intuitively write like so:

sourcetype="timelog" | stats avg(request_duration), count(request_duration) by requested_file

Of course, this is invalid syntax because stats only allows one input column.

What is the proper way to write this search?

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

The stats command allows many input columns and many aggregation functions on any or all of them. The above syntax is valid and correct for what you have stated.