Splunk Search

Add AVG to Chart Results

jessicadrechsel
New Member

Hello everyone.

I want to make a statistic of tickets. How many are opend everyday by CI Name. And I wnat to add an AVG of Tickets opened over all days.

CI Name2021-01-202021-01-202021-01-20AVG
Test 15112,3
Test 23333
     

 

Thats my current search:

 

index=prod_test 
| dedup dv_number 
| eval openday=strftime(strptime(opened_at, "%Y-%m-%d %H:%M:%S"), "%Y-%m-%d")  
| chart count(dv_number) as anzahl by dv_cmdb_ci openday
| sort anzahl desc

 

Labels (1)
0 Karma

tscroggins
Influencer

@jessicadrechsel 

Here's one possibility using timechart, appendpipe, and transpose:

index=prod_test
| timechart limit=0 span=1d useother=f count by dv_number
| eval _time=strftime(_time, "%F")
| appendpipe [ | stats avg(*) as * | eval _time="AVG" ]
| transpose 0 column_name="dv_number" header_field="_time"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...