average count of events over days of the week

[mrigendra]

I wonder if it is possible to compute average number of events over the days of the weeks, i.e. Monday, Tuesday... for the whole month. The following code will compute over dates of the month, which I don't want. I want to look weekly pattern in my data.
source="xxxx" | stats count by date_mday

Thanks!

[kristian_kolb]

Not sure if this is what you want, but you can surely do something along the line of;

source=xxx | eval zzz = date_wday . "-" . date_mday | stats count by zzz

You can run this search with the "Month to date" timepicker option, with the following result;

zzz          count
Monday-13    453
Thursday-6   431
Tuesday-21   419
Sunday-8     398
...

[carasso]

use eval strftime.

[Ayn]

Yeah it wasn't a correction, just a heads up for mrigendras - I know I'm not alone in having assumed all events have those fields 🙂

[kristian_kolb]

That is true. But since mrigendras question mentions the use of date_mday, it can be assumed that the date_* fields are available in this case.

[Ayn]

Just beware that the date_* fields do NOT necessarily exist in all events. For instance events retrieved from Windows event logs do not have them.