https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267601#M80504 <P>Thanks Martin both searches worked great my mistake.</P> Thu, 08 Oct 2015 21:04:33 GMT pavanae 2015-10-08T21:04:33Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267596#M80499 <P>Hi</P> <P>I have the following search which displays the Average of a field, but I am trying to put a time chart in hourly which shows the average of that particular hour.</P> <P>…..My Search……|rex "&lt;Total_Amount_Due&gt;(?&lt;amount&gt;\d+.\d+)&lt;/Total_Amount_Due&gt;" | stats count by amount | where amount &gt; 0 | stats avg(amount) as average<BR /> How to modify my search to display the hourly average count?</P> <P>Any help or Suggestions?</P> Tue, 29 Sep 2020 07:32:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267596#M80499 pavanae 2020-09-29T07:32:13Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267597#M80500 <P>You could use this:</P> <PRE><CODE>... | rex ... | timechart span=1h count dc(amount) as dc | eval average = count / dc | fields - count dc </CODE></PRE> <P>This will count the events per hour and the number of different <CODE>amount</CODE> values to then compute the average.</P> <P>Alternatively, you could do this:</P> <PRE><CODE>... | rex ... | bin span=1h _time | stats count by _time amount | timechart span=1h avg(count) as average </CODE></PRE> <P>Note, I've changed <CODE>avg(amount)</CODE> to <CODE>avg(count)</CODE>, not sure if that was intentional in your question or not.</P> Thu, 08 Oct 2015 19:34:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267597#M80500 martin_mueller 2015-10-08T19:34:54Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267598#M80501 <P>Hi everything seems good but it was giving the wrong average. </P> Thu, 08 Oct 2015 20:04:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267598#M80501 pavanae 2015-10-08T20:04:29Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267599#M80502 <P>Try to use Martin's 2nd query with avg(amount) in the timechart.</P> Thu, 08 Oct 2015 20:43:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267599#M80502 somesoni2 2015-10-08T20:43:28Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267600#M80503 <P>If both don't produce results you like then please do post sample data along with intended results.</P> Thu, 08 Oct 2015 20:46:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267600#M80503 martin_mueller 2015-10-08T20:46:08Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267601#M80504 <P>Thanks Martin both searches worked great my mistake.</P> Thu, 08 Oct 2015 21:04:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267601#M80504 pavanae 2015-10-08T21:04:33Z https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267602#M80505 <P>It sounds like all you want is:</P> <PRE><CODE>... My Search ...|rex "&lt;Total_Amount_Due&gt;(?&lt;amount&gt;\d+.\d+)&lt;/Total_Amount_Due&gt;" | timechart span=1h avg(amount) </CODE></PRE> Thu, 20 Oct 2016 09:54:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-my-stats-avg-x-search-to-an-hourly-timechart/m-p/267602#M80505 tedwroks 2016-10-20T09:54:58Z