Splunk Search

stats for a given time range for last 30 days

Explorer

I would like to get an average of a any given value for a time range say 7:00 PM to 8:00 PM over last 30 days.

Would I need to use sum(eval(if(_Time >= StartTime,if (_time<=EndTime,ValueToSum,0),0) and then calculate the average?

Tags (2)
0 Karma

Path Finder

that's one of doing it.

I would suggest building it as follows:

  1. specify fields earliest,latest to narrow the range
  2. use the where command to limit the start/end times of each day, further narrowing your dataset
  3. apply the stats command across that range

for example


earliest=-31d latest=-1d | where strftime(_time, "%H") > "18" AND strftime(_time, "%H") < "21" | stats count(FIELD) over _time

Explorer

Thank you. I am planning to use this in a monitoring scenario so if error counts in last 30 minutes increase more than the 30 day average (during the same 30 minutes) then we have a problem. So would you recommend sticking to rounded 30 minutes or do last 30 minutes?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!