Splunk Search

Timechart with events/h and average events per hour

ckunath
Communicator

Hello,

I want to create a timechart that shows the amount of events per hour in the last 24 hours,
and a line in it that shows the average events per hour of the last 5 days. So far I'm stuck with this:

index=test ACTION=RECEIVE | eval events=1 | timechart span=1h sum(events)

How can I calculate the average events per hour of the last n-days and add it in that chart?
Any help is highly appreciated!

0 Karma
1 Solution

andrey2007
Contributor

Hello, ckunath

May be it is not optimal query but hope help you solve your task

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

View solution in original post

0 Karma

andrey2007
Contributor

Hello, ckunath

May be it is not optimal query but hope help you solve your task

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...