Splunk Search

timechart span value produces different averages for the day

Path Finder

Case 1: earliest=-1d@d latest=-0d@d ... | timechart span=1h count as Samples, avg(duration) as avg
vs.
Case 2: earliest=-1d@d latest=-0d@d ... | timechart span=1d count as Samples, avg(duration) as avg

The value for Samples is the same in both cases (if the 24 separate Samples in Case 1 are added), but the value for avg is not (if the 24 separate averages in Case 1 are averaged).
Why is that?

Tags (4)
1 Solution
Super Champion

If you are averaging an average (in case 2, you are taking an average of 24 averages), you will get a different value than if you average all of the original numbers together right away (case 1)
http://www.incontext.indiana.edu/2013/mar-apr/article3.asp
this link is just a quick example of some averaging of averages vs actual averages.

SplunkTrust

Count would remain same regardless of the bucketing is done. The average however depends upon the total/number of instances. Daily average will be same if the count is same for every hour for that day. Take this data sample

``````Hour    duration
Hour1   100
Hour1   10
Hour1   10
Hour2   10
Hour2   10
Hour2   10
Hour2   10
``````

Now the Average for the day (when span=1d) will be (100+10+10+10+10+10+10)=160/7=22.86

Average when span1d
Hour1=100+10+10=120/3=40
Hour 2=10+10+10+10=40/4=10
Average of hourly average= 40+10/2 (number of hours)=25.

Super Champion

If you are averaging an average (in case 2, you are taking an average of 24 averages), you will get a different value than if you average all of the original numbers together right away (case 1)
http://www.incontext.indiana.edu/2013/mar-apr/article3.asp
this link is just a quick example of some averaging of averages vs actual averages.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...