Getting Average for this search

[tefa627]

I am trying to get each value to be divided by certain number (x). So if x=7, the first value would be 138.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

tefa627_1-1598279958774.png

[isoutamo · Accepted solution]

Hi

could you try this

....
| chart eval(count(<your field name>)/7) AS field_div_by_7 by channel time_hour

r. Ismo 

[tefa627]

How would I round the results?

[isoutamo]

Time by time you must add ’ to surround <<FIELD>> to get SPL to known that it’s a field like

| foreach * [ eval <<FIELD>> = round(‘<<FIELD>>’,2)]

r. Ismo