Splunk Search
Highlighted

Raw data into calculation.

Communicator

Timestamp: 1/21/2014 9:40:08 Number of records : 1 Total Size of the records : 1481

Timestamp: 1/21/2014 3:22:06 Number of records : 6 Total Size of the records : 13032

Timestamp: 1/22/2014 7:12:41 Number of records : 1 Total Size of the records : 2573

Above is a sample from my data after I listed the indexes I need. I need to find daily averages of the both columns. I felt the problem is ":" that I need equal sign instead. I accept the fact that this probably a real newbie on question, thanks for your time.

0 Karma
Highlighted

Re: Raw data into calculation.

SplunkTrust
SplunkTrust

First you'll need to extract the two numbers into fields: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields
Second you'll need to send those fields into a timechart, something like this:

your query producing fields foo and bar | timechart span=1d avg(foo) as foo_average avg(bar) as bar_average

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart for reference.

0 Karma
Highlighted

Re: Raw data into calculation.

Ultra Champion

The easiest way to try this out is to do it via rex, which extracts these field for the duration of the search. I.e. the configuration is not stored in any config file:

your search for events | rex "Number\sof\records\s+:\s+(?<rec_num>\d+)\s+Total Size of records\s+:\s+(?<rec_size>\d+) | timechart span=1d avg(rec_num) avg(rec_size)

/K

View solution in original post

Highlighted

Re: Raw data into calculation.

Communicator

Thanks for the answer. With little modification, it worked fine for me. IFX tool was really helpful on making these modifications.

0 Karma