Why does Alerting when timetaken for job completion exceeds averagetime?

[jrb65]

Trying to find Time Taken for last 7 days for a batch job using splunk search, trying to find the average of the time taken and then finding the jobs that have time taken greater than average time.

splunk search | eval sTime=strptime(StartTime, "%B %d, %Y %I:%M:%S %p") | eval eTime=strptime(EndTime, "%B %d, %Y %I:%M:%S %p") | eval TimeTaken = ceil((eTime-sTime)/60) | stats avg(TimeTaken) as avgtime by JobbName | where TimeTaken > avgtime

Once I use the stats average command, the TimeTaken values are not coming up . Tried using streamstats but averagetime calculation is not right

[yuanliu · Accepted solution]

The command you are looking for is eventstats.

splunk search
| eval sTime=strptime(StartTime, "%B %d, %Y %I:%M:%S %p")
| eval eTime=strptime(EndTime, "%B %d, %Y %I:%M:%S %p")
| eval TimeTaken = ceil((eTime-sTime)/60)
| eventstats avg(TimeTaken) as avgtime by JobbName
| where TimeTaken > avgtime

[jrb65]

Thanks yuanliu for the help.