Splunk Search

Getting Average for this search

tefa627
Explorer

I am trying to get each value to be divided by certain number (x). So if x=7, the first value would be 138.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

tefa627_1-1598279958774.png

 

Tags (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

0 Karma

tefa627
Explorer

How would I round the results?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like

| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’,2)]


r. Ismo

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...