Splunk Search

How to use tstats in search?

Vani_26
Path Finder

Hi all
when i run my original query i am getting one result and when i execute the same query using tstats i am getting different output.
AVG IS NOT MATCHING.
how to modify the query to match the count.

my original query:

 

 

index=apl-cly-sap   sourcetype=cly:app:sap  |search processName="applicationstatus"  |stats avg(plantime)

 

 

output:
1233.43223454

 
tstats query:

 

 

|tstats count where index=apl-cly-sap   sourcetype=cly:app:sap  TERM(processName=applicationstatus) by PREFIX(plantime=)
|rename plantime= as Time
 |stats avg(Time)

 

 


output:
1345.7658755

Labels (1)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

That is because your second query (with tstats) is equivalent to

index=apl-cly-sap   sourcetype=cly:app:sap
|search processName="applicationstatus"
| stats count by plantime
| stats avg(plantime)

which is semantically different from your first one.

Unless plantime is extracted at index time, there is no way to do avg on this field in tstats.

Vani_26
Path Finder

@yuanliu What you said is correct, but when i use tstats i am getting avg of plantime but not matching the count with  original query.

As per my knowledge, when i run a tstats query if the field is not an index time field it will throw error and not show any results.
But here i am getting the results but avg of plantime is not matching. if i am getting results means the plantime is indextime field right?

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Your first search is semantically equivalent to this tstats (provided that all values of the field processName are extracted from key-value pair with equal sign):

 

| tstats avg(plantime) where index=apl-cly-sap sourcetype=cly:app:sap  TERM(processName=applicationstatus)

 

Do you mean you get non-null result from the above that is different from your first search?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...