When I plug this query into splunk and go to visualization and select line chart, I get a flat line. Under the visualization it shows _time as a column and avg(count) as a column. Under _time it lists days. Under avg(count) it lists1.0000 for every day.
The visualization shows a flat line, but should be varying because the avg(count) of the userId should not be 1.0000 every day. It varies but tends to be around 6.
Adding "by userId" to the end of the query creates a column for every userId, and there are thousands. I do not want a line for every userId.
I have tried taking _time out so that by query is "index=foo | stats count by userId | timechart avg(count)" but then I get "No results found". There are events that should be found however.