Splunk Search

How to get an average per day

tefa627
Explorer

I am trying to get an average for the last (x) days for a that specific day and hour. 

This search lists a count for the current day. I am trying to achieve an average for a specific field for the last 5 Mondays or Tuesdays or Wednesday..etc.  So if today was Monday, the first value, AL-A at 00, would be the average of the past (x) Mondays at 00 for AL-A.

index=net_auth_long
| eval time_hour=strftime(_time,"%H")
| chart count over channel by time_hour limit=30

 

 
 

example.PNG

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.  

index=_internal earliest=-5w@d
| eval today=lower(strftime(now(),"%a"))
| eval dow=lower(strftime(_time, "%a"))
| where today=dow
| timechart span=1w avg(specifiField) by channel
---
If this reply helps you, Karma would be appreciated.
0 Karma

tefa627
Explorer

What goes in specific field? I need it to be count by haven't use a count command.

0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...