Hi, I hava data in the log like the following:
userId url status time
123 /abc success 1000
123 /abc failed 100000
234 /abc success 1200
I would like to generate a report that returns
How can I achieve this with stats and other Splunk functions?
Using a single search:
index=foo | eval time_success=if(status="success",time,"") | stats COUNT(status) AS "Total Requests" AVG(time_success) AS "Average time - Success"
"time_success" stores only the values that should be averaged together. The stats command is then used to calculate both the total count and the average time of success
index=blah sourcetype=bleh | stats count AS "Total Requests"
index=blah sourcetype=bleh status=success | stats avg(time) AS "Avg time - successful"
If you want the result in one search, you can use the append search command. See the docs.