Determine frequency over time

[chrisj]

I am attempting to work out the frequency of events over the selected timespan in weeks.  Basically: count of events in current timespan divided by weeks in timespan.

I can get a count of events for the selected timespan using:

index=mydata
| stats count(eval(ishotfix= "false")) as hfx
| fields hfx

I can get the timepicker span weeks using (im sure this is terrible):

| makeresults
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| fields timepickerSpanWeeks

and if I combine I am getting no results

| makeresults
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| map search="search index=mydata"
| stats count(eval(ishotfix= "false")) as hfx
| eval rate=round((hfx/timepickerSpanWeeks), 2)
| fields rate

thanks in advance!

[ITWhisperer]

Try this

index=mydata
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| stats count(eval(ishotfix= "false")) as hfx
| eval rate=round((hfx/timepickerSpanWeeks), 2)

[chrisj · Accepted solution]

index=mydata
| addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| where ishotfix= "false"
| eventstats count(timepickerSpanWeeks) as counter
| eval rate = round(counter / timepickerSpanWeeks,2)
| top rate
| fields rate

This is what got me the result, it seems like a poor way of getting it but the number of results isn't large.  Happy for someone to revise! 🙂  Thanks for your help @ITWhisperer