Splunk Search

How can a row of average hourly event volume be appended to a chart with Fridays' hourly totals and added totals?

crisjnelson
Explorer

Here is my attempt at creating a chart of hourly counts for previous Fridays. I have added row and column totals, but can't quite figure out how to add hourly averages per day.

index=everything earliest=-2week@week date_wday="friday"
| eval date = strftime(_time, "%Y-%m-%d")
| eval date_hour = strftime(_time, "%H")
| chart count by date_hour date useother=f usenull=f
| addtotals col=t labelfield=date_hour label="Total"
| appendpipe [ | stats avg(count) as date by date_hour
| eval date_hour = "Average" ]

Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...