Splunk Search

Calculating average by week?

vonsolo29
Explorer

how do Icalculate the average number of events for each week for this search

index=dcl EventCode=4740 | eval date=strftime(_time,"%Y-%m-%d") | timechart span=7d count
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you want a simple average daily count over a week, try this untested query:

index=dcl EventCode=4740 | timechart span=7d count as Avg | eval Avg=round(Avg/7, 2) 
---
If this reply helps you, Karma would be appreciated.

JoshSaunders
Explorer

And is there a way to restrict the average for the first query to only Monday through Friday of the current week, but also only include days that have past (for example, if it's Thursday, show the daily average for Monday through Thursday)?

Tags (1)
0 Karma

JoshSaunders
Explorer

Thank you for this. How would you do that same thing, but for daily average for this month only?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...