Splunk Search

Problems with average duration

mattheuslima
Explorer

Hi,folks.

I trying timechart the average duration but the I'm not get the average values for all spa's of times.

The query is like this:
"
(index=a) OR (index=b)

|transaction Reg_ID|search eventcount=2 |bin _time span=1m |timechart avg(duration) as media (DATE RANGE 15 MIN)

But it only show the result for 5 min,for example .

Even when I make the average with the stats sum and c.

I can clarify it if more with you need.

Tks for help!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mattheuslima,
let me understand:
you want to timechart the average duration in a timeframe of 15 minutes with span=1m,
in the transaction, you want to thake the earliest time,
is it correct?

If this is your need try something like this (that's faster!):

(index=a) OR (index=b) earliest=-15m@m latest=now
| bin span=1m _time
| stats earliest(_time) AS _time avg(duration) AS duration count BY Reg_ID
| timechart avg(duration) AS media

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...