calculate average of last 30 days

[thomaap]

below average function is not giving me the correct value for last 30 days.Kindly advise

| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTime

[richgalloway]

The streamstats avg(diff) as average window=30 command will calculate the average diff over the previous 30 events, not necessarily 30 days. Try this, instead:

<compute diff>
| bucket span=30d _time
| stats avg(diff) as average by _time
| eval avrg = round(average, 2)

[thomaap]

i tried updating to be above code.however it does not seem to give me the correct value .The existing values are not returning after the change .

index=MY_INDEX JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTime

[richgalloway]

That's the nature of stats, which seemed fine since your question asked about calculating average and said nothing about preserving other values.

[richgalloway]

I see no attempt to calculate an average in that SPL. What field do you want to average?

[thomaap]

| eval stTime=strptime(startTime, "%a %B %d %Y %H:%M:%S")
| eval edTime=strptime(e_Time, "%a %B %d %Y %H:%M:%S")
| eval diff=edTime-stTime
| eval diff= round(diff/60,2)
| eval diff=edTime-stTime
| eval diff= round(diff/60,2)
| streamstats avg(diff) as average window=30
| eval avrg=round(average,2)
looks like the entire query was not posted