topic Re: Splunk Query to show average count and minimum for date_month and date_day in Splunk Search

Splunk Query to show average count and minimum for date_month and date_day

Strangertinz — Tue, 13 Feb 2024 02:04:00 GMT

Hi,

I created a column chart in Splunk that shows month but will like to also indicate the day of the week for each of those months

Sample query
-------------------
index=_internal
| bucket _time span =1d
|eval month=strftime(_time,"%b")
| eval day=strftime(_time,"%a")
| stats avg(count) as Count max(count) as maximum by month, day

Re: Splunk Query to show average count and minimum for date_month and date_day

gcusello — Tue, 13 Feb 2024 07:53:30 GMT

Hi @Strangertinz,

your search seems to be correct, what's your issue?

Ciao.

Giuseppe

Re: Splunk Query to show average count and minimum for date_month and date_day

Strangertinz — Tue, 13 Feb 2024 13:37:37 GMT

The issue is the graph shows month on the x axis and I want it to indicate both month and day of the week

Re: Splunk Query to show average count and minimum for date_month and date_day

gcusello — Tue, 13 Feb 2024 13:40:10 GMT

Hi @Strangertinz ,

please try this:

index=_internal | bucket _time span =1d | eval date=strftime(_time,"%a-%b") | stats avg(count) as Count max(count) as maximum by date

Ciao.

Giuseppe

Re: Splunk Query to show average count and minimum for date_month and date_day

Strangertinz — Tue, 13 Feb 2024 14:02:34 GMT

Thanks for your quick response but the query is not working

Re: Splunk Query to show average count and minimum for date_month and date_day

gcusello — Tue, 13 Feb 2024 14:30:59 GMT

Hi @Strangertinz ,

sorry but what do you want to calculate with avg(count) and max(count)?

count isn't a field to calculate average or maximun.
you can have the count of events by period

index=_internal | bucket _time span =1d | eval date=strftime(_time,"%a-%b") | stats count by date

Ciao.

Giuseppe

Re: Splunk Query to show average count and minimum for date_month and date_day

Strangertinz — Tue, 13 Feb 2024 14:36:01 GMT

I want to calculate average count per day and maximum count per month. Like all the Mondays , Tuesdays of a given month combined and averaged