Splunk Search

timechart average of a sum

dinisco
Explorer

I have a row for each host in my source data. I want to sum the values of two fields for all hosts and display on a chart. Since there are 4 entries for each host for each minute, that sum needs to be averaged as the chart stretches out over time. This attempt doesn't seem to be working. It seems to be averaging the fields for the hosts:


host=hostname* |stats sum(writes) as writes_sum, sum(reads) as reads_sum by host,_time |timechart avg(writes_sum), avg(reads_sum)

Not sure what I'm doing wrong, any ideas? Thanks.

Tags (3)
0 Karma

Lucas_K
Motivator

Any reason you don't just use the timechart avg directly?

host=hostname* |timechart avg(writes), avg(reads) by host

You can then adjust your bucket size if required.

edit: i re-read your question again.

would a "timechart per_minute(writes), per_minute(reads) by host" be what your after?

0 Karma

Lucas_K
Motivator

So you want just read and write and don't care about hosts? (ie just the two fields?). If so then just leave the host off. The "by" command just separates it into series. Sorry im just not quite understanding the required output so im guessing 😞

0 Karma

dinisco
Explorer


host=hostname* |timechart avg(writes), avg(reads) by host

does yield somewhat useful results and I already have it in place. But it's not what I'm after. With 6 hosts it generates 12 series on the graph. I want 2.

I think per_minute might work if my data didn't have an entry for every 15 secs.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...