Let's break down the search piece by piece:
|
Search fragment |
Description |
| index=main sourcetype=access_combined |
You should now be familiar with this search from earlier recipes in this chapter. |
| | timechart span=6h avg(response) AS avg_response |
Using the timechart command, we specify a span of 6 hours. We then use the avg function on the response field. Splunk will add up all the response times in the 6-hour period and then calculate the average response time during that period. |
| | eval avg_response=round(avg_resp onse/1000,2) |
Using the eval command, we calculate the average response time in seconds by dividing the average time (which is in milliseconds) by 1000 to give us the time in seconds. The number 2 at ... |
