https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49951#M11998 <P>Perfect! thanks a lot! Really good work!</P> Wed, 15 Sep 2010 19:30:37 GMT pinzer 2010-09-15T19:30:37Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49945#M11992 <P>Hi all, i need to search the average number from the count by day of an event.</P> <P>for example if i have 3 5 and 4 events in three different days i need the average that is 4.</P> <P>the eventtype is </P> <P><CODE>eventtype="searchAccountLocked"</CODE></P> <P>i need also to use rangemap in my search...to control if the number of events of today is higher than the average. I'm using this search queri that doesn't work </P> <P><BR /><CODE>eventtype="searchAccountLocked" | stats count as count2 | timechart span=1d count | stats avg(count) |rangemap field=count2 green=1-count2 red=count2-50000 default=gray</CODE> <BR /><BR />please help me! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 14 Sep 2010 22:37:08 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49945#M11992 pinzer 2010-09-14T22:37:08Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49946#M11993 <PRE><CODE>eventtype="searchAccountLocked" | timechart span=1d count | stats avg(count) </CODE></PRE> <P>or</P> <PRE><CODE>eventtype="searchAccountLocked" | bucket span=1d _time | stats count by _time | stats avg(count) </CODE></PRE> Tue, 14 Sep 2010 23:02:59 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49946#M11993 ziegfried 2010-09-14T23:02:59Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49947#M11994 <P>thanks a lot! Good work!</P> Wed, 15 Sep 2010 15:11:11 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49947#M11994 pinzer 2010-09-15T15:11:11Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49948#M11995 <P>i need also to use rangemap in my search...to control if the number of events of today is higher than the average. I'm using this search queri that doesn't work</P> <P>eventtype="searchAccountLocked" | stats count as count2 | timechart span=1d count | stats avg(count) |rangemap field=count2 green=1-count2 red=count2-50000 default=gray</P> <P>please help me! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 15 Sep 2010 15:46:18 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49948#M11995 pinzer 2010-09-15T15:46:18Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49949#M11996 <P>You won't be able to use the rangemap command for this purpose. But you can use the eval command to do so:</P> <PRE><CODE>eventtype="searchAccountLocked" | timechart span=1d count | stats last(count) as today_count avg(count) as avg_count | eval range=if(today_count&gt;avg_count, "red", "green") </CODE></PRE> <P>Documentation on the eval command: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Eval" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Eval</A></P> Wed, 15 Sep 2010 17:40:29 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49949#M11996 ziegfried 2010-09-15T17:40:29Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49950#M11997 <P>I've added a separate answer for the solution.</P> Wed, 15 Sep 2010 17:40:55 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49950#M11997 ziegfried 2010-09-15T17:40:55Z https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49951#M11998 <P>Perfect! thanks a lot! Really good work!</P> Wed, 15 Sep 2010 19:30:37 GMT https://community.splunk.com/t5/Splunk-Search/avg-of-number-of-events-by-day/m-p/49951#M11998 pinzer 2010-09-15T19:30:37Z