Splunk Search

How to search the average per item per day?

GadgetGeek
Path Finder

I want to get the average per day per item...

e.g. Getting the total count per item is easy:

stats count(Order) as TotalOrders by ProductCategory

But I can't get the hang of adding time based searches into the mix!
i.e. Average number of Orders per day per ProductCategory?

To get:

ProductCategory    TotalOrders AverageOrdersPerDay
Fruit                 120            14
Veg                    12             1
Tags (3)
0 Karma
1 Solution

lguinn2
Legend

Try this

yoursearchstuff...
| bucket _time span=1d
| stats count(Order) as dailyOrders by ProductCategory _time
| stats sum(dailyOrders) as TotalOrders avg(dailyOrders) as AverageOrdersPerDay by ProductCategory

View solution in original post

lguinn2
Legend

Try this

yoursearchstuff...
| bucket _time span=1d
| stats count(Order) as dailyOrders by ProductCategory _time
| stats sum(dailyOrders) as TotalOrders avg(dailyOrders) as AverageOrdersPerDay by ProductCategory

GadgetGeek
Path Finder

Works a treat, but how can I specify the number of decimal places for the result?

Thanks.

0 Karma

GadgetGeek
Path Finder

Found it, added the following to the end:
| eval AverageOrdersPerDay=round(AverageOrdersPerDay, 2)

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...