topic How to TimeChart for average function avg()? in Splunk Search

How to TimeChart for average function avg()?

DPOIRE — Tue, 28 Mar 2023 16:22:08 GMT

I have this search that is working and returning a average Delay value:

Search Command

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z") | stats range(epoch_timestamp) as Delay by "logId" | stats avg(Delay)

However, I want to display the daily averages in a timechart graph to see the performance evolution by day.
Tried the following based on research but It does not return Statistic or Vizualization values (just returning events):

Search Command

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z") | stats range(epoch_timestamp) as Delay by "logId" | bucket _time span=1d | stats avg(Delay) as Performance by _time

Re: TimeChart for average function avg()

ITWhisperer — Tue, 28 Mar 2023 14:31:38 GMT

Try something by this

| eval epoch_timestamp=strptime(timestamp,"%Y-%m-%dT%H:%M:%S.%3N%:z") | stats range(epoch_timestamp) as Delay max(_time) as _time by "logId" | bucket _time span=1d | stats avg(Delay) as Performance by _time

Re: TimeChart for average function avg()

DPOIRE — Tue, 28 Mar 2023 14:53:50 GMT

Thanks, appears to partially work.
You provided the solution to my question.
However, I have this result now where Sunday is returning a zero value which is screwing up the results and trend.
How can I remove these from the results and graph?

Re: TimeChart for average function avg()

ITWhisperer — Tue, 28 Mar 2023 15:14:42 GMT

| eval Performance=if(Performance == 0,null(),Performance)