Splunk Search

average count of events over days of the week

mrigendra
New Member

I wonder if it is possible to compute average number of events over the days of the weeks, i.e. Monday, Tuesday... for the whole month. The following code will compute over dates of the month, which I don't want. I want to look weekly pattern in my data.
source="xxxx" | stats count by date_mday

Thanks!

0 Karma

kristian_kolb
Ultra Champion

Not sure if this is what you want, but you can surely do something along the line of;

source=xxx | eval zzz = date_wday . "-" . date_mday | stats count by zzz

You can run this search with the "Month to date" timepicker option, with the following result;

zzz          count
Monday-13    453
Thursday-6   431
Tuesday-21   419
Sunday-8     398
...
0 Karma

carasso
Splunk Employee
Splunk Employee

use eval strftime.

0 Karma

Ayn
Legend

Yeah it wasn't a correction, just a heads up for mrigendras - I know I'm not alone in having assumed all events have those fields 🙂

0 Karma

kristian_kolb
Ultra Champion

That is true. But since mrigendras question mentions the use of date_mday, it can be assumed that the date_* fields are available in this case.

0 Karma

Ayn
Legend

Just beware that the date_* fields do NOT necessarily exist in all events. For instance events retrieved from Windows event logs do not have them.

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...