https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228488#M67573 <P>Try this - Here I'm just replacing <CODE>stats sum(b)</CODE> with <CODE>timechart span=1d sum(b)</CODE>. When run over a 7 day timerange, instead of one row in your search result you'll get 7 (or more generally 8, since there's part of today as well as part of 8 days ago in a 7 day timerange)</P> <PRE><CODE>field_id="X" | eval b=len(_raw) | timechart span=1d sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2) </CODE></PRE> <P>UPDATE:<BR /> (sorry for forgetting the 'avg per day' bit) - you then want to calculate what the average is per day, but first of all I would make sure that your timerange is very precise about what days are being searched. The default "Last 7 days" timerange is from -7d@h to now. However this will include today up to the current time, which is bad, and also a little slice of the day that was exactly one week ago. Instead you should use the "Advanced" part of the time range picker to run this timerange: </P> <P>earliest: -7d@d<BR /> latest: @d</P> <P>That will run precisely a 7 day timerange. </P> <P>Then you can calculate the average fo those just by tacking on an extra </P> <PRE><CODE>| stats avg(mb) as MB avg(gb) as GB </CODE></PRE> Mon, 03 Oct 2016 19:48:52 GMT sideview 2016-10-03T19:48:52Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228487#M67572 <P>I have a search as follows </P> <P>field_id="X" | eval b=len(_raw) | stats sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2)</P> <P>Which displays the result in bytes,megabytes and gigabytes for a particullar search.</P> <P>Now how can i make to display the timechart count for each day and get the average count for the data?</P> Tue, 29 Sep 2020 11:16:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228487#M67572 pavanae 2020-09-29T11:16:22Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228488#M67573 <P>Try this - Here I'm just replacing <CODE>stats sum(b)</CODE> with <CODE>timechart span=1d sum(b)</CODE>. When run over a 7 day timerange, instead of one row in your search result you'll get 7 (or more generally 8, since there's part of today as well as part of 8 days ago in a 7 day timerange)</P> <PRE><CODE>field_id="X" | eval b=len(_raw) | timechart span=1d sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2) </CODE></PRE> <P>UPDATE:<BR /> (sorry for forgetting the 'avg per day' bit) - you then want to calculate what the average is per day, but first of all I would make sure that your timerange is very precise about what days are being searched. The default "Last 7 days" timerange is from -7d@h to now. However this will include today up to the current time, which is bad, and also a little slice of the day that was exactly one week ago. Instead you should use the "Advanced" part of the time range picker to run this timerange: </P> <P>earliest: -7d@d<BR /> latest: @d</P> <P>That will run precisely a 7 day timerange. </P> <P>Then you can calculate the average fo those just by tacking on an extra </P> <PRE><CODE>| stats avg(mb) as MB avg(gb) as GB </CODE></PRE> Mon, 03 Oct 2016 19:48:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228488#M67573 sideview 2016-10-03T19:48:52Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228489#M67574 <P>And How to calculate average(mb) for the past 7 days?</P> Mon, 03 Oct 2016 19:58:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228489#M67574 pavanae 2016-10-03T19:58:43Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228490#M67575 <P>Just add " <CODE>| eventstats avg(gb) as Avg</CODE> " at the end for the average for that time period.</P> Mon, 03 Oct 2016 20:00:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228490#M67575 somesoni2 2016-10-03T20:00:00Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228491#M67576 <P>D'oh - thanks somesoni2. I neglected to follow through all the way and write up how to do the avg-per-day. I've updated the answer. </P> Mon, 03 Oct 2016 20:07:13 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-the-average-of-my-search-result-for-past-7-days/m-p/228491#M67576 sideview 2016-10-03T20:07:13Z