Average and Max of Timecharted output

[siva_cg]

Hi All,

I am trying to find out the average and maximum value from the timechart output but failed. Could you please help me to get the desired output?

For example:
index=_internal type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" |timechart span=1d eval(round(sum(b)/1024/1024/1024,1)) as GB |stats avg(GB) as Average max(GB) as Peak

Output: Average Peak
Desired Output: _time GB Average Peak

Thanks in advance.

[kmaron]

instead of using timechart try using a time bucket

index=_internal type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" 
| bucket _time span=1d
| stats sum(b) as b_sum by _time
| eval GB=(round(b_sum/1024/1024/1024,1))
| stats avg(GB) as Average max(GB) as Peak