Splunk Search

average count of events over days of the week

mrigendra
New Member

I wonder if it is possible to compute average number of events over the days of the weeks, i.e. Monday, Tuesday... for the whole month. The following code will compute over dates of the month, which I don't want. I want to look weekly pattern in my data.
source="xxxx" | stats count by date_mday

Thanks!

0 Karma

kristian_kolb
Ultra Champion

Not sure if this is what you want, but you can surely do something along the line of;

source=xxx | eval zzz = date_wday . "-" . date_mday | stats count by zzz

You can run this search with the "Month to date" timepicker option, with the following result;

zzz          count
Monday-13    453
Thursday-6   431
Tuesday-21   419
Sunday-8     398
...
0 Karma

carasso
Splunk Employee
Splunk Employee

use eval strftime.

0 Karma

Ayn
Legend

Yeah it wasn't a correction, just a heads up for mrigendras - I know I'm not alone in having assumed all events have those fields 🙂

0 Karma

kristian_kolb
Ultra Champion

That is true. But since mrigendras question mentions the use of date_mday, it can be assumed that the date_* fields are available in this case.

0 Karma

Ayn
Legend

Just beware that the date_* fields do NOT necessarily exist in all events. For instance events retrieved from Windows event logs do not have them.

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...