normalize columns in timechart

[splnk1391]

Hi all

consider this search:

source=bandwidth | timechart sum(packets_in) by host

which will produce rows indexed by a timestamp, and columns headed by hostnames.

I'd like to scale values in each column via division by the average of that column.

How should I go about it? 

Many thanks.

[ITWhisperer · Accepted solution]

Assuming 1hr buckets

source=bandwidth 
| bin span=1h _time
| stats sum(packets_in) as packets_in by host _time
| eventstats avg(packets_in) as avg_in by host
| eval packets_in=packets_in/avg_in
| xyseries _time host packets_in