How to work out average

[PaulaCom]

Hi all 

i have a search running with the following results

date_year                   count 

2022                             44,814

how do i get the average count over the year? 

I've tried to eval date_year by 12 but this doesnt look right. 

Also have | timechart avg(date_year) and this is not working out 

any ideas?

[ITWhisperer]

What do you mean by average count over the year?

Is this average daily count over the year, or average weekly count, or average monthly count?

Whatever your time frame, you should calculate the counts for each month (for example) then take the average of these counts.

[PaulaCom]

thank you 

i'm using data from 2022

the total number of calls to our helpdesk was 45k (ish)

and need to show the average calls we receive every month 

so if i work that out in my head thats 45 / 12 = 3750 average number of calls per month

i'd like to work this out in Splunk 

thank you 

P 

[gcusello]

Hi @PaulaCom,

if you have only one value it isn't possible to calculate the average.

Could you share your search?

Ciao.

Giuseppe

[PaulaCom]

thank you 

my search is pretty basic 

index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json
| dedup id
| fillnull value=NULL 

I've set the range to 'previous year'

there is also a field called date_month which shows the number of tickets raised over each month like this:

thanks 

P:) 

[gcusello · Accepted solution]

Hi @PaulaCom,

if you want the average for month, you could calculate:

index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json
| stats count BY date_month
| stats avg(count) AS avg

Ciao.

Giuseppe

[PaulaCom]

starbar! 

thank you 🙂 

[gcusello]

Hi @PaulaCom ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[PaulaCom]

thank you 

I got a long number in my response 3759.4166666666665

so used the floor command to round it up !

thanks again for your guidance - 

P

[ITWhisperer]

The floor function rounds down not up; the ceil function will round up; the round function will round to the nearest number (with a specified level of precision).