I log different error messages in SPLUNK and want to get the average number of each error message and create an alert for this.
What I tried:
index="" AND http_message="" | timechart avg(http_message)
Unfortunately it doesn't the deliver the excepted screen.
Please try the below search and let us whether it worked.
index="" AND http_message="*" |stats count as tot by http_message,_time |stats avg(tot) as Average by _time
avg function requires a numeric field as an argument. Try this query.
index=foo http_message="*" | stats count by _time, http_message | timechart avg(count) as avg by http_message