Splunk Search

Problems with average duration

mattheuslima
Explorer

Hi,folks.

I trying timechart the average duration but the I'm not get the average values for all spa's of times.

The query is like this:
"
(index=a) OR (index=b)

|transaction Reg_ID|search eventcount=2 |bin _time span=1m |timechart avg(duration) as media (DATE RANGE 15 MIN)

But it only show the result for 5 min,for example .

Even when I make the average with the stats sum and c.

I can clarify it if more with you need.

Tks for help!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mattheuslima,
let me understand:
you want to timechart the average duration in a timeframe of 15 minutes with span=1m,
in the transaction, you want to thake the earliest time,
is it correct?

If this is your need try something like this (that's faster!):

(index=a) OR (index=b) earliest=-15m@m latest=now
| bin span=1m _time
| stats earliest(_time) AS _time avg(duration) AS duration count BY Reg_ID
| timechart avg(duration) AS media

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...