Average events per day

[womblesplunk]

Hi,

I would like to view the average number of events per day for a certain event code. It looks like I should be able to use:

"EventCode='123' | stats avg(count) by _date"

..but I don't have a data field in my log, only the _time field, which does have the data in it.

Can someone suggest a way to achieve this, perhaps by extracting a unique day field from the _time field somehow?

Many Thanks,

W

[martin_mueller]

This sounds like you're actually just looking for a timechart with a span of one day:

EventCode=123 | timechart span=1d count

See http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/timechart for reference, it's quite versatile.

[aholzer]

Try something like this:

EventCode=123 | eval date=strftime(_time,"%Y-%m-%d") | stats count by date | stats avg(count)

The strftime function allows you to extract time information from an epoch time field based on the time format. In this case it will extract only the year, month and day out of _time.

Stats count by date will get you the count of event for each day.

Stats avg(count) will get you the average of the count across all days.

Hope this helps

[linu1988]

Hello ,
if you think the eventcode can come like this or with some prefixed data then this will give you correct count. Average count per day won't be correct statistical data as you have the count by day one, average will be the same as count.

source=x "prefix_1234"|stats count(_raw) as Average_Count by date_mday

Thanks