Splunk Search

Getting Average for this search

Explorer

I am trying to get each value to be divided by certain number (x). So if x=7, the first value would be 138.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

tefa627_1-1598279958774.png

 

Tags (4)
0 Karma
1 Solution

Champion

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

View solution in original post

0 Karma

Champion

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

View solution in original post

0 Karma

Explorer

How would I round the results?

0 Karma

Champion

Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like

| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’,2)]


r. Ismo