Getting Data In

_time Issues with Monthly average

reverse
Contributor

I have data in a CSV with below format..

2 columns Date & count

All I want is monthly average ..

| timechart avg(count) span=1mon wouldn't work.

Please guide.

2019-05-01  0
2019-05-02  0
2019-05-03  0
2019-05-04  0
2019-05-05  0
2019-05-06  0
2019-05-07  0
2019-05-08  136
2019-05-09  62208
2019-05-10  56432
2019-05-11  618
2019-05-12  5604
2019-05-13  130244
2019-05-14  152660
2019-05-15  137472
2019-05-16  147968
2019-05-17  130330
2019-05-18  1315
2019-05-19  1007
2019-05-20  137305
2019-05-21  165069
2019-05-22  145031
2019-05-23  135697
2019-05-24  139552
2019-05-25  390
2019-05-26  203
2019-05-27  196
2019-05-28  154001
2019-05-29  160133
2019-05-30  160315
2019-05-31  145855
2019-06-01  1540
2019-06-02  1471
2019-06-03  184624
2019-06-04  192080
2019-06-05  199334
2019-06-06  176690
2019-06-07  168967
2019-06-08  490
2019-06-09  1684
2019-06-10  206361
2019-06-11  227472
2019-06-12  212830
2019-06-13  214682
2019-06-14  176739
2019-06-15  338
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query.

| inputlookup yourlookup.csv
| eval _time=strptime(Date, "%Y-%m-%d")
| timechart avg(count) span=1mon

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query.

| inputlookup yourlookup.csv
| eval _time=strptime(Date, "%Y-%m-%d")
| timechart avg(count) span=1mon

reverse
Contributor

Perfect! Thank you .. worked like a charm .

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...