Splunk Search

Problems with average duration

mattheuslima
Explorer

Hi,folks.

I trying timechart the average duration but the I'm not get the average values for all spa's of times.

The query is like this:
"
(index=a) OR (index=b)

|transaction Reg_ID|search eventcount=2 |bin _time span=1m |timechart avg(duration) as media (DATE RANGE 15 MIN)

But it only show the result for 5 min,for example .

Even when I make the average with the stats sum and c.

I can clarify it if more with you need.

Tks for help!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mattheuslima,
let me understand:
you want to timechart the average duration in a timeframe of 15 minutes with span=1m,
in the transaction, you want to thake the earliest time,
is it correct?

If this is your need try something like this (that's faster!):

(index=a) OR (index=b) earliest=-15m@m latest=now
| bin span=1m _time
| stats earliest(_time) AS _time avg(duration) AS duration count BY Reg_ID
| timechart avg(duration) AS media

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...