Splunk Search

How to get an average per day

tefa627
Explorer

I am trying to get an average for the last (x) days for a that specific day and hour. 

This search lists a count for the current day. I am trying to achieve an average for a specific field for the last 5 Mondays or Tuesdays or Wednesday..etc.  So if today was Monday, the first value, AL-A at 00, would be the average of the past (x) Mondays at 00 for AL-A.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

 
 

example.PNG

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.  

index=_internal earliest=-5w@d
| eval today=lower(strftime(now(),"%a"))
| eval dow=lower(strftime(_time, "%a"))
| where today=dow
| timechart span=1w avg(specifiField) by channel
---
If this reply helps you, an upvote would be appreciated.
0 Karma

tefa627
Explorer

What goes in specific field? I need it to be count by haven't use a count command.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!