Splunk Search

Problems with average duration

mattheuslima
Explorer

Hi,folks.

I trying timechart the average duration but the I'm not get the average values for all spa's of times.

The query is like this:
"
(index=a) OR (index=b)

|transaction Reg_ID|search eventcount=2 |bin _time span=1m |timechart avg(duration) as media (DATE RANGE 15 MIN)

But it only show the result for 5 min,for example .

Even when I make the average with the stats sum and c.

I can clarify it if more with you need.

Tks for help!

Labels (2)
0 Karma

gcusello
Esteemed Legend

Hi @mattheuslima,
let me understand:
you want to timechart the average duration in a timeframe of 15 minutes with span=1m,
in the transaction, you want to thake the earliest time,
is it correct?

If this is your need try something like this (that's faster!):

(index=a) OR (index=b) earliest=-15m@m latest=now
| bin span=1m _time
| stats earliest(_time) AS _time avg(duration) AS duration count BY Reg_ID
| timechart avg(duration) AS media

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...