All Apps and Add-ons

Using timewrap, trying to dynamically determine average based on event_count.

ericrobinson
Path Finder

Great app.. I just cant figure out how to assign a value that matches the event_count or anything else (closed_txn count)

In the example below, he shows how to calculate rolling 7 day average, but its a static number.

My dashboard uses "Business week to date". So I want my denominator for the average to be the number of day I am in the week (or event_count as mentioned above). I have just so far been unsuccessful in getting it to work.

Monday=total/1; Tuesday=total/2; Wednesday=total/3 etc..

  • | timechart count span=1h | timewrap d series=short | addtotals s* | eval 7dayavg=Total/7.0 <-Basically, how do I make this dynamic based on the number of runs, or day of the week?-> | table _time, _span, s0, s1, 7dayavg | rename s0 as now, s1 as yesterday
0 Karma

somesoni2
Revered Legend

Try like this

your base search | timechart count span=1h
| timewrap d series=short
| addtotals s* | eval noofdays=0 | foreach s* [eval noofdays=noofdays+1 ]
| eval Dailyavg=Total/noofdays
| table _time, _span, s0, s1, Dailyavg
| rename s0 as now, s1 as yesterday

sloshburch
Ultra Champion

@ericrobinson: Did that answer your question?

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...