I'm a brand new Splunk user, so I apologize if this is an extremely basic question. This is the query I'm running:
loggingAppId=ABC loggingOperationName=Operation.Name loggingMethodName=Logging.Method | timechart count by loggingAppId
This is functioning as expected. However, I would like to get the average of the results. i.e. If I run this for a 30 day time span, I'd like the average of those 30 days. Here's an example of a query I've attempted unsuccessfully to get this:
loggingAppId=ABC loggingOperationName=Operation.Name loggingMethodName=Logging.Method | stats avg count by loggingAppId
I'd greatly appreciate if someone could tell me what I'm doing wrong. Thanks a lot from a newbie!
