Splunk Search

timechart by count, average(timetaken) by type

dukechandu
New Member

Hi,

i have data like below

Type count timeTakenToexceute time
abc 2 2 sec 09-01-2016, 09-02-2016
xyz 1 1 sec 09-01-2016

needed timechart based on day, i am trying like below but missing count
..... | timechart span=1d avg(timetaken) by type

please help

thanks in advance.

Tags (1)
0 Karma

somesoni2
Revered Legend

Try like this. It will create fields like AvgTime :Type and Count :Type. E.g. AvgTime :abc, Count: xyz

..... | timechart span=1d avg(timetaken) as AvgTime count as Count by type
0 Karma

somesoni2
Revered Legend

Both Average and count fields are different entity and can possibly have different magnitude in the y-axis. Why do you want to merge both? do you want to merge both average and count for each type? If yes, then just remove by type in the above query.

0 Karma

sundareshr
Legend

Try this

... | bin span=1d _time | stats avg(timetaken) as average count by _time typ
0 Karma

dukechandu
New Member

Thank you for your answers, but the issue i am facing here for count its showing separate bar, but i need both average and count displaying in single bar, is it possible.

please find the below image, first two bars shows average time taken and second two bars shows count of each type, i want there four bars in two bars displaying average and count.

alt text

thanks in advance

0 Karma

sundareshr
Legend
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...