topic Re: How to edit my search to find the average events per second for each day from the past week? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363057#M107244 <P>You want to calculate EPS for each index or for all? Also, you say each day of past week, so you expect 7 rows with showing average of each day of last week?</P> Fri, 23 Jun 2017 22:08:17 GMT somesoni2 2017-06-23T22:08:17Z How to edit my search to find the average events per second for each day from the past week? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363055#M107242 <P>I am using the following query to calculate the average events per second</P> <PRE><CODE>| tstats count where index=* groupby index, _time span=1s | stats avg(count) as AverageCountPerSec </CODE></PRE> <P>However, the number is lower than one of the indexes. What did I miss? How to calculate the average events per second for each day from the past week?</P> <P>Thanks.</P> Fri, 23 Jun 2017 20:30:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363055#M107242 splunkrocks2014 2017-06-23T20:30:18Z Re: How to edit my search to find the average events per second for each day from the past week? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363056#M107243 <P>try this, </P> <P>Average, </P> <PRE><CODE>| tstats count where index=* by index _time span=1s | stats avg(count) as avg by _time </CODE></PRE> <P>Overall, </P> <PRE><CODE>| tstats count where index=* by _time span=1s </CODE></PRE> <P>For index wise, </P> <PRE><CODE>| tstats count where index=* groupby index, _time span=1s | xyseries _time, index, count </CODE></PRE> Fri, 23 Jun 2017 20:34:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363056#M107243 vasanthmss 2017-06-23T20:34:33Z Re: How to edit my search to find the average events per second for each day from the past week? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363057#M107244 <P>You want to calculate EPS for each index or for all? Also, you say each day of past week, so you expect 7 rows with showing average of each day of last week?</P> Fri, 23 Jun 2017 22:08:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-average-events-per-second-for/m-p/363057#M107244 somesoni2 2017-06-23T22:08:17Z