Adding and average into a simple Dashboard. I assume this is difficult.

[Jgreiner]

index=mainframe

sourcetype=BMC:DEFENDER:RACF:bryslog

host=s0900d OR host=s0700d 


| timechart limit=50 count(event) BY host
| addcoltotals

I am looking add the AVG from each 1 week total for each day 

[ITWhisperer]

You could try something like this

| appendpipe
    [| stats avg(*) as average_*]
| addcoltotals 
| foreach average_*
    [| eval <<MATCHSEG1>>=if(isnull(<<MATCHSEG1>>),<<FIELD>>,<<MATCHSEG1>>)]
| fields - average_*

[Jgreiner]

That is amazing, Thank you.  I am new to the Splunk world as you can see.  How about a field next to each host that calculating the %of the total average per count?

[ITWhisperer]

It isn't clear what you mean here, % of the total average? Do you mean the percentage of the total for that host that the count represents, or the percentage of the grand total for that host? Since you have also used timechart, I guess you could also mean the percentage of the total for the time bin that the count for the host represents.

It is probably best if you work out what it is that you are trying to show in your table/chart to clarify what the required calculation is.

[Jgreiner]

This is what i am looking for: well maybe
Date                                  S0100D                    S0400D
Friday 2024-04-11    4880961 (75%)     5247555 (35%)

AVG                                     34509759             4750349554

If that makes sense

[ITWhisperer]

Not really,  4880961 (75%) means what?  4880961 isn't 75% of any of your other figures.

[Jgreiner]

these were dummy numbers, apologies.  percent change of the average

This is what i am looking for:
Date                                       S0100D                    S0400D
Friday       2024-04-11    200 (50%)               250 (25%)

Saturday 2024-04-11    600 (50%)               1750  (75%)

AVG                                        400                             1000