Splunk Search

## Timechart with events/h and average events per hour

Communicator

Hello,

I want to create a timechart that shows the amount of events per hour in the last 24 hours,
and a line in it that shows the average events per hour of the last 5 days. So far I'm stuck with this:

``````index=test ACTION=RECEIVE | eval events=1 | timechart span=1h sum(events)
``````

How can I calculate the average events per hour of the last n-days and add it in that chart?
Any help is highly appreciated!

Tags (5)
1 Solution
Contributor

Hello, ckunath

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

Contributor

Hello, ckunath

index=test ACTION=RECEIVE earliest=-24h | eval events=1 | timechart span=1h sum(events) as T | eval temp_field="field_for_join"
| join temp_field [search index=test ACTION=RECEIVE earliest=-5d | eval events=1 | stats count(events) as Count_hour_mday by date_hour date_mday
| stats avg( Count_hour_mday) as avg_events | eval temp_field="field_for_join" ]

Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...