2 Replies Latest reply on Mar 22, 2019 8:42 AM by Arthur Nigro

    Splunk Response time by a sub-category using weight

    Arthur Nigro
      Share:|

      Does anyone have any examples of the parameters to enter for Query Column for Weight? I have a set of data by day and don't want to average each day because the weekends have different volumes.

       

      using the example below, I want the average to rollup to 1.84 seconds (using weight), not 3.67 (which is the average of all 7 datapoints ignoring volume).

       

       

      Avg R/TVolume
      10100
      11000
      1.51500
      2.5800
      1.251200
      1.51500
      8200
        • 1. Re: Splunk Response time by a sub-category using weight
          Marco Colombo

          Hi, here is an example based on your data.

          Let's map this to TOTAL_EVENTS Business driver metric.

          A query containing your data point could be:

           

          SELECT '2019-03-20 00:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 10 AS VALUE, 100 AS WEIGHT FROM DUAL
          UNION
          SELECT '2019-03-20 01:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 1 AS VALUE, 1000 AS WEIGHT FROM DUAL
          UNION
          SELECT '2019-03-20 02:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 1.5 AS VALUE, 1500 AS WEIGHT FROM DUAL
          UNION
          SELECT '2019-03-20 03:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 2.5 AS VALUE, 800 AS WEIGHT FROM DUAL
          UNION
          SELECT '2019-03-20 04:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 1.25 AS VALUE, 1200 AS WEIGHT FROM DUAL
          UNION
          SELECT '2019-03-20 05:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 1.5 AS VALUE, 1500 AS WEIGHT FROM DUAL
          UNION
          SELECT '2019-03-20 06:00:00' AS TS, 3600 AS DURATION, 's1' DS_WKLDNM, 'TOTAL_EVENTS' AS OBJNM, 8 AS VALUE, 200 AS WEIGHT FROM DUAL
          

           

          WEIGHT, AVG and WAVG values will be stored into DWH as separate statistics.

          So, you will have those samples at hour level:

           

          SELECT ts,avgvalue,wavgvalue,weight FROM wkld_data_dh WHERE wkldobjid=XXX
          

           

          DH.png

           

          and this sample at day aggregation level:

           

          SELECT ts,avgvalue,wavgvalue,weight FROM wkld_data_d WHERE wkldobjid=XXX
          

           

          D.png

           

          Every metric has a default statistics shown in charts and can be simply overridden in analysis editor.

          For example, in order to show both, AVG and WAVG values for the above sample, you can edit analysis in advanced mode and select the 2 stats as follow:

           

          Screenshot_2.png

           

          And the result will be:

           

          Screenshot_3.png

           

           

          Regards

          • 2. Re: Splunk Response time by a sub-category using weight
            Arthur Nigro

            Thank you Marco for your comment, how would this be done with the Moviri - Splunk Generic Extractor?

             

            I have 3 columns, one for type (calc_type), one for Volume (CalcCount), one for AvergeDuration (CalcAvergeDuration).

             

            Using my example above, here is an updated example. NOTE: Calc_type doesn't really apply here.

             

              

            CalcAverageDurationCalcCount
            10100
            11000
            1.51500
            2.5800
            1.251200
            1.51500
            8200