Using avg func with stats to find the average of a result for a week

[anushamkrishna]

Hi,

I am using the following query, which gives me the result as 281 occurences in a month. Now I need to find the average of this result per day. How to get this??

tag="poc" "[TRAFFIC]" ACTIVE_FULL_SCREEN_FOCUSED | stats count

[jdunlea_splunk]

If you change the search to:

tag="poc" "[TRAFFIC]" ACTIVE_FULL_SCREEN_FOCUSED | bin span=1d _time | stats count by _time

This will give you the count per day.

If you then add on " | stats avg(count)" it will show you the average per day.

Hope this helps!