Splunk Search

Splunk Query to show average count and minimum for date_month and date_day

Strangertinz
Path Finder

Hi, 

I created a column chart in Splunk that shows month but will like to also indicate the day of the week for each of those months

Sample query
-------------------
index=_internal
| bucket _time span =1d
|eval month=strftime(_time,"%b")
| eval day=strftime(_time,"%a")
| stats avg(count) as Count max(count) as maximum by month, day

Labels (6)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Strangertinz,

your search seems to be correct, what's your issue?

Ciao.

Giuseppe

0 Karma

Strangertinz
Path Finder

The issue is the graph shows month on the x axis and I want it to indicate both month and day of the week 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Strangertinz ,

please try this:

index=_internal
| bucket _time span =1d
| eval date=strftime(_time,"%a-%b")
| stats avg(count) as Count max(count) as maximum by date

Ciao.

Giuseppe

0 Karma

Strangertinz
Path Finder

Thanks for your quick response but the query is not working 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Strangertinz ,

sorry but what do you want to calculate with avg(count) and max(count)?

count isn't a field to calculate average or maximun.
you can have the count of events by period

index=_internal
| bucket _time span =1d
| eval date=strftime(_time,"%a-%b")
| stats count by date

Ciao.

Giuseppe

0 Karma

Strangertinz
Path Finder

I want to calculate average count per day and maximum count per month. Like all the Mondays , Tuesdays of a given month combined and averaged 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...