Splunk Search

How to search the average per item per day?

GadgetGeek
Path Finder

I want to get the average per day per item...

e.g. Getting the total count per item is easy:

stats count(Order) as TotalOrders by ProductCategory

But I can't get the hang of adding time based searches into the mix!
i.e. Average number of Orders per day per ProductCategory?

To get:

ProductCategory    TotalOrders AverageOrdersPerDay
Fruit                 120            14
Veg                    12             1
Tags (3)
0 Karma
1 Solution

lguinn2
Legend

Try this

yoursearchstuff...
| bucket _time span=1d
| stats count(Order) as dailyOrders by ProductCategory _time
| stats sum(dailyOrders) as TotalOrders avg(dailyOrders) as AverageOrdersPerDay by ProductCategory

View solution in original post

lguinn2
Legend

Try this

yoursearchstuff...
| bucket _time span=1d
| stats count(Order) as dailyOrders by ProductCategory _time
| stats sum(dailyOrders) as TotalOrders avg(dailyOrders) as AverageOrdersPerDay by ProductCategory

GadgetGeek
Path Finder

Works a treat, but how can I specify the number of decimal places for the result?

Thanks.

0 Karma

GadgetGeek
Path Finder

Found it, added the following to the end:
| eval AverageOrdersPerDay=round(AverageOrdersPerDay, 2)

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...