I am looking for a way to calculate the avg rate of occurrence for a particular field. There are multiple values given in this field, but we want to see at the avg rate how often they occur.
Here is the simple base search which finds all values for exit_status:
index=contract_gateway_summary earliest=-14d@d | stats count by exit_status | dedup exit_status
Any help would be greatly appreciated.
Thanks in advance!
Try this. Adjust the span based on your avg rate period (showing avg count per day with span=1d, for avg count per hour, change span=1h etc)
index=contract_gateway_summary earliest=-14d@d | bucket span=1d _time | stats count by _time exit_status | stats avg(count) as AvgPerDay by exit_status