Splunk Search

average count of events over days of the week

mrigendra
New Member

I wonder if it is possible to compute average number of events over the days of the weeks, i.e. Monday, Tuesday... for the whole month. The following code will compute over dates of the month, which I don't want. I want to look weekly pattern in my data.
source="xxxx" | stats count by date_mday

Thanks!

0 Karma

kristian_kolb
Ultra Champion

Not sure if this is what you want, but you can surely do something along the line of;

source=xxx | eval zzz = date_wday . "-" . date_mday | stats count by zzz

You can run this search with the "Month to date" timepicker option, with the following result;

zzz          count
Monday-13    453
Thursday-6   431
Tuesday-21   419
Sunday-8     398
...
0 Karma

carasso
Splunk Employee
Splunk Employee

use eval strftime.

0 Karma

Ayn
Legend

Yeah it wasn't a correction, just a heads up for mrigendras - I know I'm not alone in having assumed all events have those fields 🙂

0 Karma

kristian_kolb
Ultra Champion

That is true. But since mrigendras question mentions the use of date_mday, it can be assumed that the date_* fields are available in this case.

0 Karma

Ayn
Legend

Just beware that the date_* fields do NOT necessarily exist in all events. For instance events retrieved from Windows event logs do not have them.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...