Splunk Search

Getting Average for this search

tefa627
Explorer

I am trying to get each value to be divided by certain number (x). So if x=7, the first value would be 138.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

tefa627_1-1598279958774.png

 

Tags (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

View solution in original post

0 Karma

tefa627
Explorer

How would I round the results?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like

| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’,2)]


r. Ismo

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!