How to calculate average rate of occurrence for a field?

[_gkollias]

Hello,

I am looking for a way to calculate the avg rate of occurrence for a particular field. There are multiple values given in this field, but we want to see at the avg rate how often they occur.

Here is the simple base search which finds all values for exit_status:

index=contract_gateway_summary  earliest=-14d@d | stats count by exit_status  | dedup exit_status

Any help would be greatly appreciated.

Thanks in advance!

[somesoni2]

Try this. Adjust the span based on your avg rate period (showing avg count per day with span=1d, for avg count per hour, change span=1h etc)

index=contract_gateway_summary  earliest=-14d@d | bucket span=1d _time | stats count by _time exit_status | stats avg(count) as AvgPerDay by exit_status