aggregate hourly events

[elaine0102]

Hi, how can I get aggregate hourly events. The search command using "avg"?
Guide please. Thankyou.

[Ayn]

So, let's say you have events that represent tweets (one event per tweet) and you want to get a average of some time period on how many tweets are made daily.

First of all get a count per day, then use the numbers you just got to get your average.

(some search that finds your tweet events) | timechart span=1d count | stats avg(count)

[elaine0102]

Yes, I would need some numbers to create some charts for my events. My application is actually displaying my company's Twitter information. I thought of displaying on average, how many tweets my company tweets daily.

Mathematics term I know is to add all the tweets daily and divide by number of days.

However, in Splunk's language, I do not know how. I look at Splunk documentation for search language however I do not understand the part where they used "avg".

[Ayn]

The information you provide isn't sufficient to give any meaningful answer. How do you mean what your events are, "on average"? Do you want some kind of number, and if so, which?

[elaine0102]

I actually want to know on average what is my daily/hourly/monthly events. Can you guide me on either 1. Thank you.

By chance if you have any idea about this thread: http://splunk-base.splunk.com/answers/65303/issue-regarding-date_wday

[Ayn]

Provide more details on your scenario please. Thankyou.