timechart avg vs count

[bowa]

I would use the example on this page as the base for my question:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration)

Averages are great ... but if there is a spike i would like to know the size of the sample the average was taken over.

So i would like to add to this timechart also the count of the number of transactions in that timeframe.

Anyone know if this is possible ?

[Ayn · Accepted solution]

The transaction command produces two fields, duration and eventcount. You could use eventcount in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount)

[bowa]

Thanks a lot ! exactly what i needed