topic Re: Month based count need to be displayed in average in Splunk Search

How to display average in month based count?

btcs2 — Fri, 18 Mar 2022 16:54:34 GMT

| chart count over date_month by seriesName , I have a search that display counts over month by seriesname . but instead of this count i need to display average of the count over month by series name ..

date_month seriesName 1 seriesName 2 seriesName 3


1	march	%	%	%
2	feb	%	%	%

Re: Month based count need to be displayed in average

somesoni2 — Fri, 18 Mar 2022 15:34:30 GMT

If you want to display daily average during that month, try something like this

Your base search | bucket span=1d _time | stats count by _time seriesName | eval date_month=strftime(_time,"%b") | chart avg(count) over date_month by seriesName

Re: Month based count need to be displayed in average

btcs2 — Mon, 21 Mar 2022 08:25:05 GMT

Not working as expected . its just give count ,not giving average

Re: Month based count need to be displayed in average

ITWhisperer — Mon, 21 Mar 2022 09:20:43 GMT

The example given by @somesoni2 does seem to do what you seem to have asked for.

If it is not working for you, please can you share the search you are actually using, so we can try to see why?

Re: Month based count need to be displayed in average

btcs2 — Mon, 21 Mar 2022 10:03:32 GMT

Yes that query works but that's not what i was looking for .. may be my requirement is not clear

The average should be in such a way that (row wise) like in the month of match 15 percentage of event is series 1 and 35 percentage is series 2 and 50 percentage is series 3 . series is nothing but events like offer created or something. i can show example ..

Find average to the total events in that month to each event(occurrence percentage of each events compare to total events for each month)

date_month	series1	series2	series3
March	15%	35%	50%
February	16%	36%	48%

base query | chart count over date_month by seriesName this is the query that we use now . it gives count in expected way ..

Re: Month based count need to be displayed in average

ITWhisperer — Mon, 21 Mar 2022 10:08:41 GMT

OK so you don't want the average, you want the percentage of the total for the month that each series has?

Re: Month based count need to be displayed in average

btcs2 — Mon, 21 Mar 2022 13:00:50 GMT

Thank you so much .. !! its working as expected . need to learn all these 🙂