Assessing an Avg on an seen IP

[itsmevic]

Hello,

I'd like to run an average over the course of May 16, 2020 (24-hours), on a particular IP address.  I'd like to see an event count on this IP with an average overlay over the course of a 24-hour timespan on the indicated date above.

Heres my base query:

index=* "IP Address"
|timechart count by src
|sort -count

Suggestions are greatly welcomed and very much appreciated.

[to4kawa]

index=your_index src="X.X.X.X"
|timechart span=1h count 
|eventstats avg(count) as hourly_avg

an average over the course of May 16, 2020 (24-hours)

I'm not sure because the units are not indicated.
People all love average, but most of the time the formula isn't obvious.

[richgalloway]

You have your own suggestion right there. Does it not work as expected? If not. what are you getting compared to what you want?
Be aware that searching for an IP address can be a problem because of the way Splunk treats the dots in the address. You may need to use the TERM operator.

[itsmevic]

Unfortunately, the TERM operator doesn't work due to the IP's [.] dot's. I tried searching on TERM(xx.xx.xxx.xxx) and the search choked.