Search code examples
splunksplunk-query

How to get results for individual fields per second

I have the following query which gives me per second average results for the events. Is there a way I can modify it to produce the individual average results for each CLIENT? Thanks.

 index=some_some2_idx ns=something app_name=my-api 
 CLIENT IN (Apple, Orange, Banana) API IN (R_GET, T_GET) 
 | timechart span=1s count as requests_per_second | stats avg(requests_per_second)

This is currently outputting: 

avg(requests_per_second)
 18.39494

I am looking to get results as follows: 

Apple     Orange     Banana
 5.1       5.9        7.39
Solution 
  • index=some_some2_idx ns=something app_name=my-api 
 CLIENT IN (Apple, Orange, Banana) API IN (R_GET, T_GET) 
 | timechart span=1s count by CLIENT | stats AVG(*) by *