Getting daily count and overall average

[Sam2]

Hello all,

I'm trying to get the stats of the count of events per day, but also the average.

...| stats count by date_mday is fine for getting the count per day

and

...| stats count by date_mday | stats avg(count) gets the overall daily average

However, I'd like to combine those two into a single table, with one column being the daily total, and the second column being the overall average (which will of course be the same value every day).

I think I'm just struggling with the syntax...can anyone help please?????

[tom_frotscher · Accepted solution]

I think you can use eventstats for this:

| stats count by date_mday | eventstats avg(count)

[prakash007]

index=main host=wrs* domain=zzz* | stats count as daycount by date_mday | eventstats avg(daycount)

when i use run the above command for past 7days...i see different values for daycount which is expected, but i'm getting same values for avg(daycount) for all 7 days....can you explain me how it works...??

[jwalzerpitt]

If want to see a moving average try using | streamstats avg(daycount)

Breakdown of eventstats vs. streamstats that may help clear up what each one does
http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/

[Taruchit]

Hello Sir,

I am trying to fetch count of errors in application logs on daily basis and average count of errors in past 7 days.

I tried using the following: -

index=** <Search condition> |stats count by error |streamstats avg(count)

I get three columns: error, count, avg(count). I am able to follow the results obtained in first two columns, but unable to understand how the values are getting calculated and displayed for avg(count). Thus, need your help to comprehend the same.

Thank you

[khubyarb]

Thanks for the streamstats tip

[kenvanderheyden]

Exactly what i was looking for. Thanks

[Sam2]

Yes, easy when you know the command!

Thanks.