This one is a little tricky because you need to search a month of data in order to get the average, but still process daily results as well. Here was my stab at it, searching over the "Last 30 Days":
index=os_linux NOT root tag=authentication NOT tag=failure
| bucket _time span=1d
| stats count(eval(_time=relative_time(now(),"@d"))) as count, count as total by host, user, eventtype, src_ip
| search eventtype=*authentication*
| eval dest_count=host+":"+src_ip+"("+count+")", average=total/30
| stats values(dest_count) as Daily, values(average) as Average by user, eventtype
By bucketing the _time in 1 day increments, we can grab just the count of today's events and the total count. Will this do the trick for you?