Splunk Search

average for sucessfully requests

New Member

Hi, I hava data in the log like the following:

userId    url     status    time
123       /abc    success   1000
123       /abc    failed    100000
234       /abc    success   1200

I would like to generate a report that returns

  1. total # of requests
  2. average time for sucessful requests

How can I achieve this with stats and other Splunk functions?

Tags (1)
0 Karma


Using a single search:

index=foo | eval time_success=if(status="success",time,"") | stats COUNT(status) AS "Total Requests" AVG(time_success) AS "Average time - Success"

"time_success" stores only the values that should be averaged together. The stats command is then used to calculate both the total count and the average time of success

Ultra Champion
  1. index=blah sourcetype=bleh | stats count AS "Total Requests"

  2. index=blah sourcetype=bleh status=success | stats avg(time) AS "Avg time - successful"

If you want the result in one search, you can use the append search command. See the docs.


Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!