https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174381#M50029 <P>Hi</P> <P>As per this question <A href="http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html">http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html</A></P> <PRE><CODE>sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count </CODE></PRE> <P>This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest)</P> <P>If you want to average all of those results, you would add the <CODE>stats avg(count)</CODE> at the end of the search:</P> <PRE><CODE>sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count) </CODE></PRE> <P>This will average out the number of events per hour...</P> <P>If you have a specific event you are looking for, that would go at the beginning:</P> <PRE><CODE>sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | sort - count sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | stats avg(count) </CODE></PRE> Fri, 14 Aug 2015 11:32:47 GMT lloydd518 2015-08-14T11:32:47Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174380#M50028 <P>Hello</P> <P>Please can you provide a search for getting the number of events per hour and average count per hour?</P> Fri, 14 Aug 2015 10:25:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174380#M50028 shellnight 2015-08-14T10:25:28Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174381#M50029 <P>Hi</P> <P>As per this question <A href="http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html">http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html</A></P> <PRE><CODE>sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count </CODE></PRE> <P>This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest)</P> <P>If you want to average all of those results, you would add the <CODE>stats avg(count)</CODE> at the end of the search:</P> <PRE><CODE>sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count) </CODE></PRE> <P>This will average out the number of events per hour...</P> <P>If you have a specific event you are looking for, that would go at the beginning:</P> <PRE><CODE>sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | sort - count sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | stats avg(count) </CODE></PRE> Fri, 14 Aug 2015 11:32:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174381#M50029 lloydd518 2015-08-14T11:32:47Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174382#M50030 <P>THANK YOU VERY MUCH !!!</P> Fri, 14 Aug 2015 12:26:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-and-average-count-of-events-per-hour/m-p/174382#M50030 shellnight 2015-08-14T12:26:07Z