Splunk Search

How to calculate average rate of occurrence for a field?

_gkollias
SplunkTrust
SplunkTrust

Hello,

I am looking for a way to calculate the avg rate of occurrence for a particular field. There are multiple values given in this field, but we want to see at the avg rate how often they occur.

Here is the simple base search which finds all values for exit_status:

index=contract_gateway_summary  earliest=-14d@d | stats count by exit_status  | dedup exit_status

Any help would be greatly appreciated.

Thanks in advance!

Tags (4)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this. Adjust the span based on your avg rate period (showing avg count per day with span=1d, for avg count per hour, change span=1h etc)

index=contract_gateway_summary  earliest=-14d@d | bucket span=1d _time | stats count by _time exit_status | stats avg(count) as AvgPerDay by exit_status
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...