Getting Data In

_time Issues with Monthly average

reverse
Contributor

I have data in a CSV with below format..

2 columns Date & count

All I want is monthly average ..

| timechart avg(count) span=1mon wouldn't work.

Please guide.

2019-05-01  0
2019-05-02  0
2019-05-03  0
2019-05-04  0
2019-05-05  0
2019-05-06  0
2019-05-07  0
2019-05-08  136
2019-05-09  62208
2019-05-10  56432
2019-05-11  618
2019-05-12  5604
2019-05-13  130244
2019-05-14  152660
2019-05-15  137472
2019-05-16  147968
2019-05-17  130330
2019-05-18  1315
2019-05-19  1007
2019-05-20  137305
2019-05-21  165069
2019-05-22  145031
2019-05-23  135697
2019-05-24  139552
2019-05-25  390
2019-05-26  203
2019-05-27  196
2019-05-28  154001
2019-05-29  160133
2019-05-30  160315
2019-05-31  145855
2019-06-01  1540
2019-06-02  1471
2019-06-03  184624
2019-06-04  192080
2019-06-05  199334
2019-06-06  176690
2019-06-07  168967
2019-06-08  490
2019-06-09  1684
2019-06-10  206361
2019-06-11  227472
2019-06-12  212830
2019-06-13  214682
2019-06-14  176739
2019-06-15  338
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Please try below query.

| inputlookup yourlookup.csv
| eval _time=strptime(Date, "%Y-%m-%d")
| timechart avg(count) span=1mon

View solution in original post

harsmarvania57
Ultra Champion

Hi,

Please try below query.

| inputlookup yourlookup.csv
| eval _time=strptime(Date, "%Y-%m-%d")
| timechart avg(count) span=1mon

reverse
Contributor

Perfect! Thank you .. worked like a charm .

0 Karma

harsmarvania57
Ultra Champion

Welcome 🙂

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...