Splunk Search

Timechart with events/h and average events per hour

ckunath
Communicator

Hello,

I want to create a timechart that shows the amount of events per hour in the last 24 hours,
and a line in it that shows the average events per hour of the last 5 days. So far I'm stuck with this:

index=test ACTION=RECEIVE | eval events=1 | timechart span=1h sum(events)

How can I calculate the average events per hour of the last n-days and add it in that chart?
Any help is highly appreciated!

0 Karma
1 Solution

andrey2007
Contributor

Hello, ckunath

May be it is not optimal query but hope help you solve your task

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

View solution in original post

0 Karma

andrey2007
Contributor

Hello, ckunath

May be it is not optimal query but hope help you solve your task

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...