https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115135#M30456 <P>Have you looked at <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/X11">X11</A> ? Or <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Trendline">trendline</A> ? Trendline has exponential moving averages as well as weighted moving averages.</P> Tue, 11 Nov 2014 18:00:47 GMT aljohnson_splun 2014-11-11T18:00:47Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115133#M30454 <P>This sounds so easy but I can't seem to figure it out. Or maybe it's just ridiculous and there is a better way.</P> <P>So I have </P> <PRE><CODE>index=iis | timechart count by cs_uri_stem </CODE></PRE> <P>And that's great, but what if I want to smooth out the timechart with an average? Or maybe just plot the deltas? Doing avg(count(_raw)) doesn't cut the mustard. Basically I want to try and stomp down the occasional spikes (which yes need attention in some circumstances) and just get an idea if hitcount is trending up. Any ideas?</P> Mon, 10 Nov 2014 17:12:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115133#M30454 robertlabrie 2014-11-10T17:12:00Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115134#M30455 <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonStatsFunctions">Percentiles, variance, population variance, sum of squares, and standard deviation all come to mind.</A></P> <P>There is also a <CODE>delta</CODE> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Delta">command</A> if that is really what you want. </P> <P>Here are some similar questions that might help you craft your search:</P> <P><A href="http://answers.splunk.com/answers/141302/plot-rate-of-change.html">http://answers.splunk.com/answers/141302/plot-rate-of-change.html</A></P> <P><A href="http://answers.splunk.com/answers/102969/display-standard-deviation-stdev-percentage.html">http://answers.splunk.com/answers/102969/display-standard-deviation-stdev-percentage.html</A></P> Mon, 10 Nov 2014 19:41:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115134#M30455 aljohnson_splun 2014-11-10T19:41:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115135#M30456 <P>Have you looked at <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/X11">X11</A> ? Or <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Trendline">trendline</A> ? Trendline has exponential moving averages as well as weighted moving averages.</P> Tue, 11 Nov 2014 18:00:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115135#M30456 aljohnson_splun 2014-11-11T18:00:47Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115136#M30457 <P>| timechart span=1h count as events | eventstats sum(events) as z| eventstats count(events) as y |eval average=round(z/y,2)|fields </P> Tue, 11 Apr 2017 18:41:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115136#M30457 Sukisen1981 2017-04-11T18:41:48Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115137#M30458 <P>| timechart span=1h count as events | eventstats sum(events) as z| eventstats count(events) as y |eval average=round(z/y,2)|fields </P> <P>Ultimately the average = sum/count</P> Tue, 11 Apr 2017 18:43:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-average-count-of-events-for-a-timechart/m-p/115137#M30458 Sukisen1981 2017-04-11T18:43:12Z