I log different error messages in SPLUNK and want to get the average number of each error message and create an alert for this.
What I tried:
index="" AND http_message="" | timechart avg(http_message)
Unfortunately it doesn't the deliver the excepted screen.
index="*" AND http_message="*"
| timechart count BY http_message
| untable _time http_message count
| stats avg(count) BY http_message
The avg function requires a numeric field as an argument. Try this query.
| stats count by _time, http_message
| timechart avg(count) as avg by http_message
Please try the below search and let us whether it worked.
index="" AND http_message="*"
|stats count as tot by http_message,_time
|stats avg(tot) as Average by _time