how do Icalculate the average number of events for each week for this search
index=dcl EventCode=4740 | eval date=strftime(_time,"%Y-%m-%d") | timechart span=7d count
If you want a simple average daily count over a week, try this untested query:
index=dcl EventCode=4740 | timechart span=7d count as Avg | eval Avg=round(Avg/7, 2)
And is there a way to restrict the average for the first query to only Monday through Friday of the current week, but also only include days that have past (for example, if it's Thursday, show the daily average for Monday through Thursday)?
Thank you for this. How would you do that same thing, but for daily average for this month only?
