Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- aggregate hourly events
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aggregate hourly events
Hi, how can I get aggregate hourly events. The search command using "avg"?
Guide please. Thankyou.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, let's say you have events that represent tweets (one event per tweet) and you want to get a average of some time period on how many tweets are made daily.
First of all get a count per day, then use the numbers you just got to get your average.
(some search that finds your tweet events) | timechart span=1d count | stats avg(count)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I would need some numbers to create some charts for my events. My application is actually displaying my company's Twitter information. I thought of displaying on average, how many tweets my company tweets daily.
Mathematics term I know is to add all the tweets daily and divide by number of days.
However, in Splunk's language, I do not know how. I look at Splunk documentation for search language however I do not understand the part where they used "avg".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The information you provide isn't sufficient to give any meaningful answer. How do you mean what your events are, "on average"? Do you want some kind of number, and if so, which?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I actually want to know on average what is my daily/hourly/monthly events. Can you guide me on either 1. Thank you.
By chance if you have any idea about this thread: http://splunk-base.splunk.com/answers/65303/issue-regarding-date_wday
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Provide more details on your scenario please. Thankyou.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
