Plot average time between events.

[picktheneedle]

Can someone help me with the query to plot average time between events matching a field having certain value e.g msg="xyz"? The span is every 10 minutes. For e.g if events occurs 6000 times in 10 minutes, then average time between events is 600/6000 = 0.1 sec. 

Thanks

[gcusello]

Hi @picktheneedle,

you have to filter events in the main search and then count the results in each span, something like this:

index=your_index msg="xyz"
| timechart span=10m count
| eval "Average (sec)"=count/600

to adapt to your real situation.

Ciao.

Giuseppe