Splunk Search

peak day count for the day of the month and avg for the month

francly
Explorer

Hi, I get the exactly same count for avg and peak, any issue with my query?

 

index=a sourcetype=ab earliest=-30d latest=now
 | bucket _time span=1mon
 | stats count by _time
 | eval date_month=strftime(_time, "%b")
 | eval date_day=strftime(_time, "%a")
 | stats avg(count) as AverageCountPerDay max(count) AS Peak_Per_Month by date_month, date_day

 

date_month date_day AverageCountPerDay Peak_Per_Month

AugSun8203765082037650
JulThu46219954621995
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Bucket is setting each _time to the beginning of the month,  stats is counting for that day so you are only getting one count for each month, so average and max are the same

0 Karma

francly
Explorer

What is the query I should use?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!