How to use a timechart to get an average count of monthly sales?

[zacksoft]

I want to use a timechart to get an average count of monthly sales.
But when I use span=30d it calculates average of 30 days from the current day. So, if I am running the query in the middle of the month it calculates average 15 days of the current month and 15 days of the previous month.

But I don't want that.
I want it to be a monthly average calculation like for whole of Jan or whole of Feb ...etc...

| timechart span=1d eval(round(avg(sales),2)) as avgSales

[thambisetty · Accepted solution]

Hi,

try something like below,

index=_internal host=splunk-test  sourcetype=splunkd count=*
| timechart span=1mon avg(count)

It gives average of count for every month.

[niketn]

@zacksoft refer to one of my older answers. This answer does Week by Week calculation, but you can adjust the same approach for Month on Month. https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

[thambisetty]

what is the time range you are taking from time picker?
span will split from the time chosen from time picker. so, if you chose the correct month in time picker, you will see average for the chosen month.

[zacksoft]

I am choosing from last 2 years till Now.

[thambisetty]

try span=1mon

[zacksoft]

If I choose span=1mon, and today is 27th July. Will it calculate avg between 1st Jul to 27th July and June-1 to 30 and May 1to 31st and April 1st to 30th etc............ ?

[thambisetty]

exactly. that's correct

[zacksoft]

Thank you.