I have a need to compare the average time for certain events with the 5 min bucket/bins of the same events. The idea is to find 5 min intervals that deviate more than a certain percentage from the average response times and then in some way display those intervals.
I am however struggling to figure out how to output the Average for the entire time period but also calculate the 5 minute intervals.
The following query, returns nothing (can you even do 2 Stats in the same query?):
search | stats avg(Value) as AvgEntirePeriod | bin _time span=5m | stats avg(Value) by _time
Any ideas on how to write this?
Hi @dmoberg,
you can use eventstats to have the average of the full period, something like this:
search
| eventstats avg(Value) as AvgEntirePeriod
| bin _time span=5m
| stats
avg(Value) AS AvgFiveMinutes
values(AvgEntirePeriod) AS AvgEntirePeriod
BY _time
| eval perc=round(AvgFiveMinutes/AvgEntirePeriod*100,2)
Ciao.
giuseppe
You can do as many stats calls as you like in a query, but what you need is eventstats. Also timechart can be used to replace the bin and stats.
search | timechart span=5m avg(Value) as binAvg | eventstats avg(binAvg) as allAvg
Hi @dmoberg,
you can use eventstats to have the average of the full period, something like this:
search
| eventstats avg(Value) as AvgEntirePeriod
| bin _time span=5m
| stats
avg(Value) AS AvgFiveMinutes
values(AvgEntirePeriod) AS AvgEntirePeriod
BY _time
| eval perc=round(AvgFiveMinutes/AvgEntirePeriod*100,2)
Ciao.
giuseppe
Thanks! The EventStats did the trick
Hi @dmoberg,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉