Splunk Search

Getting Average for this search

tefa627
Explorer

I am trying to get each value to be divided by certain number (x). So if x=7, the first value would be 138.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

tefa627_1-1598279958774.png

 

Tags (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

0 Karma

tefa627
Explorer

How would I round the results?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like

| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’,2)]


r. Ismo

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...