topic Re: Getting Average for this search in Splunk Search

Getting Average for this search

tefa627 — Mon, 24 Aug 2020 14:39:45 GMT

I am trying to get each value to be divided by certain number (x). So if x=7, the first value would be 138.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

isoutamo — Mon, 24 Aug 2020 15:01:19 GMT

could you try this

.... | chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo

tefa627 — Fri, 11 Sep 2020 21:13:27 GMT

How would I round the results?

isoutamo — Sat, 12 Sep 2020 08:34:58 GMT

Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like

| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’,2)]

r. Ismo