Splunk Search

Timechart with events/h and average events per hour

Communicator

Hello,

I want to create a timechart that shows the amount of events per hour in the last 24 hours,
and a line in it that shows the average events per hour of the last 5 days. So far I'm stuck with this:

``````index=test ACTION=RECEIVE | eval events=1 | timechart span=1h sum(events)
``````

How can I calculate the average events per hour of the last n-days and add it in that chart?
Any help is highly appreciated!

Tags (5)
1 Solution
Contributor

Hello, ckunath

May be it is not optimal query but hope help you solve your task

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

Contributor

Hello, ckunath

May be it is not optimal query but hope help you solve your task

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...