Aggregating an aggregated message

Comments

1 comment

  • Avatar
    Derek Hall

    Hi Mike,

    You can tie two aggregate operators together by designating a comma in between them, also order of operation matters. For your example here are a couple options.

    If you'd like to be able to plot the average data per request over time (for plotting on a line graph) use this syntax:

    _sourceCategory=SOURCE*

    | parse ":80 * * * * * * * \"GET http://*:80" as a,b,c,d,e,recv,sent,domain

    | timeslice by 1m

    | count as total_requests , sum(sent) as total_sent by _timeslice

    | total_sent / total_requests as avg_sent_per_request

    feel free to adjust the timeslice size based on your overall timewindow for the search.

    If you want to just get one overall avg value you can use this syntax:

    _sourceCategory=SOURCE*

    | parse ":80 * * * * * * * \"GET http://*:80" as a,b,c,d,e,recv,sent,domain

    | count as total_requests, sum(sent) as total_sent

    | total_request / total_sent as avg_sent_per_request

     

    Hope that helps!

    0
    Comment actions Permalink

Please sign in to leave a comment.