Splunk Search

Splunk Query to show average count and minimum for date_month and date_day

Strangertinz
Path Finder

Hi, 

I created a column chart in Splunk that shows month but will like to also indicate the day of the week for each of those months

Sample query
-------------------
index=_internal
| bucket _time span =1d
|eval month=strftime(_time,"%b")
| eval day=strftime(_time,"%a")
| stats avg(count) as Count max(count) as maximum by month, day

Labels (6)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Strangertinz,

your search seems to be correct, what's your issue?

Ciao.

Giuseppe

0 Karma

Strangertinz
Path Finder

The issue is the graph shows month on the x axis and I want it to indicate both month and day of the week 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Strangertinz ,

please try this:

index=_internal
| bucket _time span =1d
| eval date=strftime(_time,"%a-%b")
| stats avg(count) as Count max(count) as maximum by date

Ciao.

Giuseppe

0 Karma

Strangertinz
Path Finder

Thanks for your quick response but the query is not working 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Strangertinz ,

sorry but what do you want to calculate with avg(count) and max(count)?

count isn't a field to calculate average or maximun.
you can have the count of events by period

index=_internal
| bucket _time span =1d
| eval date=strftime(_time,"%a-%b")
| stats count by date

Ciao.

Giuseppe

0 Karma

Strangertinz
Path Finder

I want to calculate average count per day and maximum count per month. Like all the Mondays , Tuesdays of a given month combined and averaged 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...