how i can find the average number of events per day using SOS app metrics in splunk ?
the search index=* | timechart span=1d count as dailycount takes hours and hangs
Try this
index=_internal sourcetype=splunkd group=per_index_thruput |timechart span=1d sum(ev) as dailycount
Update please
Get the below error Error in 'timechart' command: The specifier 'sum' is invalid. It must be in form (). For example: max(size).
