Stats with different bins (full time period AND 5 min intervals)- How to compare average time?

[dmoberg]

I have a need to compare the average time for certain events with the 5 min bucket/bins of the same events. The idea is to find 5 min intervals that deviate more than a certain percentage from the average response times and then in some way display those intervals.

I am however struggling to figure out how to output the Average for the entire time period but also calculate the 5 minute intervals.

The following query, returns nothing (can you even do 2 Stats in the same query?):

search | stats avg(Value) as AvgEntirePeriod | bin _time span=5m | stats avg(Value) by _time

Any ideas on how to write this?

[andrew_nelson]

You can do as many stats calls as you like in a query, but what you need is eventstats. Also timechart can be used to replace the bin and stats.

search | timechart span=5m avg(Value) as binAvg | eventstats avg(binAvg) as allAvg

[gcusello · Accepted solution]

Hi @dmoberg,

you can use eventstats to have the average of the full period, something like this:

search 
| eventstats avg(Value) as AvgEntirePeriod
| bin _time span=5m 
| stats 
   avg(Value) AS AvgFiveMinutes 
   values(AvgEntirePeriod) AS AvgEntirePeriod 
   BY _time
| eval perc=round(AvgFiveMinutes/AvgEntirePeriod*100,2)

Ciao.

giuseppe

[dmoberg]

Thanks! The EventStats did the trick

[gcusello]

Hi @dmoberg,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉