Splunk Search

How to get an average per day

tefa627
Explorer

I am trying to get an average for the last (x) days for a that specific day and hour. 

This search lists a count for the current day. I am trying to achieve an average for a specific field for the last 5 Mondays or Tuesdays or Wednesday..etc.  So if today was Monday, the first value, AL-A at 00, would be the average of the past (x) Mondays at 00 for AL-A.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

 
 

example.PNG

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.  

index=_internal earliest=-5w@d
| eval today=lower(strftime(now(),"%a"))
| eval dow=lower(strftime(_time, "%a"))
| where today=dow
| timechart span=1w avg(specifiField) by channel
---
If this reply helps you, Karma would be appreciated.
0 Karma

tefa627
Explorer

What goes in specific field? I need it to be count by haven't use a count command.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

It’s go time — Boston, here we come!

Are you ready to take your Splunk skills to the next level? Get set, because Splunk University is back, and ...