Splunk Search

Average count of events per field grouped by another field

rmm1982
New Member
Hello All,
I'm a relative newbie and hoping the community can help me out. I'm kind of stuck on a query and I can't figure out how to get the correct results.
 
I have an event that has a referer and a txn_id. Multiple events with the same referer field can have the same txn_id.
 
 
RefererTxn_idresponse_time
googleabcd123442
googleabcd123443
googleabcd123444
google1234abcd45
google1234abcd46
google1234abcd47
google1234abcd48
yahooxyz123110
yahoo123xyx 120
yahoo123xyz130
 
What I am trying to do is get the average number of txn_ids per referer and the avg of response times for that. So something like this:
 
 
Refereravg(count txn_id)avg(response_time)
google3.544.5
yahoo1.5120
 
Any help would be appreciated.
Thanks!
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| stats dc(Txn_id) as unique_tx_ids count avg(response_time) as average by Referer
| eval average_count_txns_id=count/unique_tx_ids
0 Karma

rmm1982
New Member

Thanks! That seemed to do it

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...