topic Re: Compare the NOW-1d count of event with the averageof the last month in Splunk Search https://community.splunk.com/t5/Splunk-Search/Compare-the-NOW-1d-count-of-event-with-the-averageof-the-last/m-p/85409#M21810 <PRE><CODE>sourcetype="sophos" pmx_action="keep" fur!="none" earliest=-30d@d latest=@d | stats count as dailyCount by date_mday | stats avg(dailyCount) as monthlyAvg | join [search sourcetype="sophos" pmx_action="keep" fur!="none" earliest=-24h@h latest=@h | stats count as todayCount ] </CODE></PRE> <P>This search gives 2 results: monthlyAvg and todayCount</P> Thu, 26 Jan 2012 11:38:54 GMT lguinn2 2012-01-26T11:38:54Z Compare the NOW-1d count of event with the averageof the last month https://community.splunk.com/t5/Splunk-Search/Compare-the-NOW-1d-count-of-event-with-the-averageof-the-last/m-p/85408#M21809 <P>Dear All,</P> <P>I've got a problem with a Splunk search. I'd like to compare the last 24 h number of sent mail with the daily average of the last month.</P> <P>The search that I'm using is the following:</P> <PRE><CODE>sourcetype="sophos" pmx_action="keep" fur!="none"| bucket span=24h _time | timechart span=24h count | stats last(count) as today_count avg(count) as avg_count </CODE></PRE> <P>The problem is that this search compare the average with the count of the event from 00.00 of the last day to the NOW time.</P> <P>My will is to compare the NOW-1d count with the average. Is it possible? Regards</P> Mon, 08 Nov 2010 17:41:39 GMT https://community.splunk.com/t5/Splunk-Search/Compare-the-NOW-1d-count-of-event-with-the-averageof-the-last/m-p/85408#M21809 fedevietti 2010-11-08T17:41:39Z Re: Compare the NOW-1d count of event with the averageof the last month https://community.splunk.com/t5/Splunk-Search/Compare-the-NOW-1d-count-of-event-with-the-averageof-the-last/m-p/85409#M21810 <PRE><CODE>sourcetype="sophos" pmx_action="keep" fur!="none" earliest=-30d@d latest=@d | stats count as dailyCount by date_mday | stats avg(dailyCount) as monthlyAvg | join [search sourcetype="sophos" pmx_action="keep" fur!="none" earliest=-24h@h latest=@h | stats count as todayCount ] </CODE></PRE> <P>This search gives 2 results: monthlyAvg and todayCount</P> Thu, 26 Jan 2012 11:38:54 GMT https://community.splunk.com/t5/Splunk-Search/Compare-the-NOW-1d-count-of-event-with-the-averageof-the-last/m-p/85409#M21810 lguinn2 2012-01-26T11:38:54Z