topic Re: Getting daily count and overall average in Splunk Search

Getting daily count and overall average

Sam2 — Wed, 06 Aug 2014 08:20:58 GMT

Hello all,

I'm trying to get the stats of the count of events per day, but also the average.

...| stats count by date_mday is fine for getting the count per day

and

...| stats count by date_mday | stats avg(count) gets the overall daily average

However, I'd like to combine those two into a single table, with one column being the daily total, and the second column being the overall average (which will of course be the same value every day).

I think I'm just struggling with the syntax...can anyone help please?????

Re: Getting daily count and overall average

tom_frotscher — Wed, 06 Aug 2014 09:35:04 GMT

I think you can use eventstats for this:

| stats count by date_mday | eventstats avg(count)

Re: Getting daily count and overall average

Sam2 — Wed, 06 Aug 2014 14:29:26 GMT

Yes, easy when you know the command!

Thanks.

Re: Getting daily count and overall average

kenvanderheyden — Fri, 30 Jan 2015 08:54:56 GMT

Exactly what i was looking for. Thanks

Re: Getting daily count and overall average

prakash007 — Wed, 25 Nov 2015 20:50:22 GMT

index=main host=wrs* domain=zzz* | stats count as daycount by date_mday | eventstats avg(daycount)

when i use run the above command for past 7days...i see different values for daycount which is expected, but i'm getting same values for avg(daycount) for all 7 days....can you explain me how it works...??

Re: Getting daily count and overall average

jwalzerpitt — Fri, 08 Jan 2016 18:48:34 GMT

If want to see a moving average try using | streamstats avg(daycount)

Breakdown of eventstats vs. streamstats that may help clear up what each one does
http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/

Re: Getting daily count and overall average

khubyarb — Thu, 23 Jun 2016 13:52:42 GMT

Thanks for the streamstats tip

Re: Getting daily count and overall average

Taruchit — Tue, 14 Sep 2021 13:17:18 GMT

Hello Sir,

I am trying to fetch count of errors in application logs on daily basis and average count of errors in past 7 days.

I tried using the following: -

index=** <Search condition> |stats count by error |streamstats avg(count)

I get three columns: error, count, avg(count). I am able to follow the results obtained in first two columns, but unable to understand how the values are getting calculated and displayed for avg(count). Thus, need your help to comprehend the same.

Thank you