Dividing Results To Get Average

[henryt1]

So the query I'm running is retiring results of how many people created a project (year to date) and I would like to find the average weekly amount. The query looks like:

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" AND /projects/create | stats count by source | eventstats avg(count) as Average by week

However when I add the 'by week' to the end of it, it doesn't generate any results but at least when I take it off it will give me the average of each of the results that are listed, but like I said I need the average per week. Any ideas?

[Stephen_Sorkin · Accepted solution]

You wouldn't calculate average per week, you'd calculate exact number per week (we use the advanced search language to first snap to the beginning of the year then the beginning of the week at the beginning of the year):

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" AND /projects/create earliest=@y@w | timechart span=1w count as "Projects Created"

If you want the average over all weeks, you can do:

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" AND /projects/create earliest=@y@w | timechart span=1w count as "Projects Created" | eventstats avg("Projects Created") as "Average Projects per Week"

[henryt1]

That's exactly what I needed! Thank you so much!

[henryt1]

I didn't know, that was just an idea I had. What value would work to give me the average per week?

[Ayn]

Where do you get the "week" value from? There is no such value by default at least.