average for sucessfully requests

[chialin]

Hi, I hava data in the log like the following:

userId    url     status    time
123       /abc    success   1000
123       /abc    failed    100000
234       /abc    success   1200

I would like to generate a report that returns

1. total # of requests
2. average time for sucessful requests

How can I achieve this with stats and other Splunk functions?

[dsheldon]

Using a single search:

index=foo | eval time_success=if(status="success",time,"") | stats COUNT(status) AS "Total Requests" AVG(time_success) AS "Average time - Success"

"time_success" stores only the values that should be averaged together. The stats command is then used to calculate both the total count and the average time of success

[kristian_kolb]

1. index=blah sourcetype=bleh | stats count AS "Total Requests"

2. index=blah sourcetype=bleh status=success | stats avg(time) AS "Avg time - successful"

If you want the result in one search, you can use the append search command. See the docs.

/K