https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381398#M169661 <P>Hello. </P> <P>Thanks for your answer. But when I am running this, I am only seeing today's data, not the average of 7 days.</P> Fri, 04 May 2018 11:37:18 GMT spoolunk 2018-05-04T11:37:18Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381396#M169659 <P>I have a query <BR /> index=errors earliest=@d latest=now |stats count(ErrorCode) as ErrorCountForToday by host </P> <P>I would like this query to show me error count for today (as doing already) and the average error count for the last 7 days . so that I can compare how much increase decrease happened. </P> <P>Currently we are using a input csv which populates a file with 7 days average data and we pick it up from there. </P> <P>Let me know if that is achievable from the query. </P> <P>Thanks,</P> Thu, 03 May 2018 12:16:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381396#M169659 spoolunk 2018-05-03T12:16:10Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381397#M169660 <P>Like this:</P> <PRE><CODE>index=errors earliest=-7d@d latest=now | timechart span=1d count(ErrorCode) AS ErrorCount BY host | untable _time host count | eval start_of_today = relative_time(now(), "@d") | eval when= if((_time &gt;= start_of_today), "Today", "Last Week") | chart avg(count) AS count BY when </CODE></PRE> Thu, 03 May 2018 14:45:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381397#M169660 woodcock 2018-05-03T14:45:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381398#M169661 <P>Hello. </P> <P>Thanks for your answer. But when I am running this, I am only seeing today's data, not the average of 7 days.</P> Fri, 04 May 2018 11:37:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381398#M169661 spoolunk 2018-05-04T11:37:18Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381399#M169662 <P>You are quite correct; there was a flaw in my original answer. Try the updated answer.</P> Fri, 04 May 2018 22:06:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381399#M169662 woodcock 2018-05-04T22:06:25Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381400#M169663 <P>Thanks, this is working now. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Mon, 07 May 2018 06:05:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381400#M169663 spoolunk 2018-05-07T06:05:34Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381401#M169664 <P>what is the updated query, could you please tell</P> Wed, 21 Aug 2019 08:00:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381401#M169664 sayanidasgupta 2019-08-21T08:00:05Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381402#M169665 <P>I edited the answer so the one that you see is the fixed one.</P> Wed, 21 Aug 2019 10:54:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381402#M169665 woodcock 2019-08-21T10:54:24Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381403#M169666 <P>Thanks much @woodcock.<BR /> Actually I am looking something like below -<BR /> Single Table containing - <BR /> stats count by DID TN - for today<BR /> avg count for last 7 day by DID and TN<BR /> deviation of today vs. Last 7 day avg count.</P> <P>e.g.</P> <P>DID TN Today Last7Dayavg Deviation - Today vs Last 7 day avg<BR /> 123 A 230 330 -100<BR /> 124 B 90 70 20</P> Thu, 22 Aug 2019 07:42:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381403#M169666 sayanidasgupta 2019-08-22T07:42:20Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381404#M169667 <P>Could you please help, could not able to do this for a long.......</P> Thu, 22 Aug 2019 07:43:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381404#M169667 sayanidasgupta 2019-08-22T07:43:26Z https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381405#M169668 <P>Ask a new question and @-me.</P> Thu, 22 Aug 2019 13:27:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-today-s-and-last-7-day-s-average-in-single-query/m-p/381405#M169668 woodcock 2019-08-22T13:27:28Z