Splunk Search

Assessing an Avg on an seen IP



I'd like to run an average over the course of May 16, 2020 (24-hours), on a particular IP address.  I'd like to see an event count on this IP with an average overlay over the course of a 24-hour timespan on the indicated date above.

Heres my base query:

index=* "IP Address"
|timechart count by src
|sort -count

Suggestions are greatly welcomed and very much appreciated.
0 Karma

Ultra Champion
index=your_index src="X.X.X.X"
|timechart span=1h count 
|eventstats avg(count) as hourly_avg

an average over the course of May 16, 2020 (24-hours)

I'm not sure because the units are not indicated.
People all love average, but most of the time the formula isn't obvious.

0 Karma


You have your own suggestion right there. Does it not work as expected? If not. what are you getting compared to what you want?
Be aware that searching for an IP address can be a problem because of the way Splunk treats the dots in the address. You may need to use the TERM operator.

If this reply helps you, Karma would be appreciated.
0 Karma


Unfortunately, the TERM operator doesn't work due to the IP's [.] dot's. I tried searching on TERM(xx.xx.xxx.xxx) and the search choked.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...