Splunk Search

Using avg func with stats to find the average of a result for a week

New Member


I am using the following query, which gives me the result as 281 occurences in a month. Now I need to find the average of this result per day. How to get this??

tag="poc" "[TRAFFIC]" ACTIVEFULLSCREEN_FOCUSED | stats count

Tags (4)
0 Karma

Splunk Employee
Splunk Employee

If you change the search to:

tag="poc" "[TRAFFIC]" ACTIVEFULLSCREEN_FOCUSED | bin span=1d _time | stats count by _time

This will give you the count per day.

If you then add on " | stats avg(count)" it will show you the average per day.

Hope this helps!