https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/523492#M147626 <P>I am trying to get an average for the last (x) days for a that specific day and hour.&nbsp;</P><P>This search lists a count for the current day. I am trying to achieve an average for a specific field for the last 5 Mondays or Tuesdays or Wednesday..etc.&nbsp; So if today was Monday, the first value, AL-A at 00, would be the average of the past (x) Mondays at 00 for AL-A.</P><P><SPAN>index=net_auth_long</SPAN><BR /><SPAN>| eval time_hour=strftime(_time,"%H")</SPAN><BR /><SPAN>| chart count over channel by time_hour limit=30</SPAN></P><P>&nbsp;</P><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="example.PNG" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11188i6D9F27B9E8E537DB/image-size/medium?v=v2&amp;px=400" role="button" title="example.PNG" alt="example.PNG" /></span></P><P> </P> Wed, 07 Oct 2020 17:26:14 GMT tefa627 2020-10-07T17:26:14Z https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/523492#M147626 <P>I am trying to get an average for the last (x) days for a that specific day and hour.&nbsp;</P><P>This search lists a count for the current day. I am trying to achieve an average for a specific field for the last 5 Mondays or Tuesdays or Wednesday..etc.&nbsp; So if today was Monday, the first value, AL-A at 00, would be the average of the past (x) Mondays at 00 for AL-A.</P><P><SPAN>index=net_auth_long</SPAN><BR /><SPAN>| eval time_hour=strftime(_time,"%H")</SPAN><BR /><SPAN>| chart count over channel by time_hour limit=30</SPAN></P><P>&nbsp;</P><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="example.PNG" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11188i6D9F27B9E8E537DB/image-size/medium?v=v2&amp;px=400" role="button" title="example.PNG" alt="example.PNG" /></span></P><P> </P> Wed, 07 Oct 2020 17:26:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/523492#M147626 tefa627 2020-10-07T17:26:14Z https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/523507#M147632 <P>See if this helps.&nbsp;&nbsp;</P><LI-CODE lang="markup">index=_internal earliest=-5w@d | eval today=lower(strftime(now(),"%a")) | eval dow=lower(strftime(_time, "%a")) | where today=dow | timechart span=1w avg(specifiField) by channel</LI-CODE> Wed, 07 Oct 2020 18:35:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/523507#M147632 richgalloway 2020-10-07T18:35:52Z https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/528029#M149063 <P>What goes in specific field? I need it to be count by haven't use a count command.</P> Wed, 04 Nov 2020 21:38:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-an-average-per-day/m-p/528029#M149063 tefa627 2020-11-04T21:38:52Z