- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
indeed_2000
Motivator
06-15-2021
10:23 PM
Hi
I have spl command like this:
| rex "duration\[(?<duration>\d+)\].*?method:\s(?<method>[^\s]+)" | xyseries _time method duration
it will produce lots of point on chart, how can I reduce number of points on chart?
for example in 1 minute over 100 “duration” points exist , I want to create 1 point each minutes and show average of that 100 point on single point per minute.
any idea?
Thanks
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
06-15-2021
10:45 PM
| rex "duration\[(?<duration>\d+)\].*?method:\s(?<method>[^\s]+)"
| timechart span=1m avg(duration) as averageDuration by method
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
06-15-2021
10:45 PM
| rex "duration\[(?<duration>\d+)\].*?method:\s(?<method>[^\s]+)"
| timechart span=1m avg(duration) as averageDuration by method
