AVG Count of a error message

[123michi19]

Good morning,

I log different error messages in SPLUNK and want to get the average number of each error message and create an alert for this.

What I tried:
index="" AND http_message="" | timechart avg(http_message)

Unfortunately it doesn't the deliver the excepted screen.

[woodcock]

Like this:

index="*" AND http_message="*" 
| timechart count BY http_message
| untable _time http_message count
| stats avg(count) BY http_message

[richgalloway]

The avg function requires a numeric field as an argument. Try this query.

index=foo http_message="*"
| stats count by _time, http_message
| timechart avg(count) as avg by http_message

[dindu]

Hi,

Please try the below search and let us whether it worked.

       index="" AND http_message="*" 
       |stats count as tot by http_message,_time
       |stats avg(tot) as Average by _time