Splunk Search

timechart avg vs count

Path Finder

I would use the example on this page as the base for my question:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration)

Averages are great ... but if there is a spike i would like to know the size of the sample the average was taken over.

So i would like to add to this timechart also the count of the number of transactions in that timeframe.

Anyone know if this is possible ?

Tags (1)
0 Karma
1 Solution

Legend

The transaction command produces two fields, duration and eventcount. You could use eventcount in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount)

View solution in original post

Legend

The transaction command produces two fields, duration and eventcount. You could use eventcount in your chart to detect spikes, for instance by taking a sum of the total events within the timespan:

eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration),sum(eventcount)

View solution in original post

Path Finder

Thanks a lot ! exactly what i needed

0 Karma