Splunk – 绘制主机 (X 轴) 上的平均事务持续时间 (Y 轴)

huangapple go评论59阅读模式
英文:

Splunk - Charting average transaction duration (Y-axis) over host (X-axis)

问题

我正在使用Splunk绘制每个主机的平均交易持续时间,参考下面的搜索查询:

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"

| chart avg(duration) by host

我现在有一个图表,其中avg(duration)以秒为单位显示在Y轴上,主机显示在X轴上。

如何将avg(duration)更改为以小数分钟表示(例如2.34分钟),而不是当前的秒数。

谢谢

英文:

I am using Splunk to chart the average duration of a transaction, for each host, refer to the search query below

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"

| chart avg(duration) by host

I now have a chart with avg(duration) in seconds as the Y-axis, host as the X-axis.

Splunk – 绘制主机 (X 轴) 上的平均事务持续时间 (Y 轴)

How do I change avg(duration) so that it's expressed in decimal minutes (something like 2.34 mins) instead of the current seconds.

Thanks

答案1

得分: 2

你可以使用 evalavg(duration) 修改为分钟单位的 Splunk 查询。以下是代码示例:

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval duration=duration/60 
| chart avg(duration) by host

希望我的回答能够帮助到你。

英文:

You can modify the avg(duration) to minutes in your Splunk query using eval.

Here's the code :

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval duration=duration/60 
| chart avg(duration) by host

Hope my answer will help.

huangapple
  • 本文由 发表于 2023年7月13日 16:51:16
  • 转载请务必保留本文链接:https://go.coder-hub.com/76677543.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定