https://community.splunk.com/t5/Splunk-Search/Calculate-average-number-of-calls-by-user/m-p/23606#M4230 <PRE><CODE>search that returns customer and call data | bin _time span=1d | stats count as calls by _time,customer </CODE></PRE> <P>Now you have the number of calls per customer per day</P> <P>The key thing is <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin">bin</A> - this massages the times to the closest day</P> <P>Add the following for average calls / day per customer :</P> <PRE><CODE>| eventstats avg(calls) as avg_calls by customer </CODE></PRE> <P>or if you don't need so much detail :</P> <PRE><CODE>| stats avg(calls) as avg_calls by customer </CODE></PRE> Fri, 02 Aug 2013 19:43:11 GMT jonuwz 2013-08-02T19:43:11Z https://community.splunk.com/t5/Splunk-Search/Calculate-average-number-of-calls-by-user/m-p/23605#M4229 <P>Here is our situation, we handle calls. Every call generates a record. We would like to find out, over the span of 1 month, what the average number of calls every customer makes. Logically you'd figure out the number of calls made by each customer every day for a month, and find the average. Then you'd find the average from each of the 30 days. I haven't been able to wrap my mind around a way to do this with splunk.</P> <P>Any ideas on how to do this? I'd appreciate the help. Thanks!</P> Fri, 02 Aug 2013 19:01:32 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-average-number-of-calls-by-user/m-p/23605#M4229 msarro 2013-08-02T19:01:32Z https://community.splunk.com/t5/Splunk-Search/Calculate-average-number-of-calls-by-user/m-p/23606#M4230 <PRE><CODE>search that returns customer and call data | bin _time span=1d | stats count as calls by _time,customer </CODE></PRE> <P>Now you have the number of calls per customer per day</P> <P>The key thing is <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin">bin</A> - this massages the times to the closest day</P> <P>Add the following for average calls / day per customer :</P> <PRE><CODE>| eventstats avg(calls) as avg_calls by customer </CODE></PRE> <P>or if you don't need so much detail :</P> <PRE><CODE>| stats avg(calls) as avg_calls by customer </CODE></PRE> Fri, 02 Aug 2013 19:43:11 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-average-number-of-calls-by-user/m-p/23606#M4230 jonuwz 2013-08-02T19:43:11Z