Hello I'm very new to Splunk and have so far been consuming data as .csv files in order to test things out. I have two main fields; USER_NAME and USER_NBR which are tied together to use (I have a SUBMIT_DATE one as well formatted in %d-%b-%y form). A User can submit multiple jobs in a day and the architects want a Daily Total by User Name and ID and a Monthly Average by User Name and ID in order to have a comparison to determine if they users are deviating over their norm. The Daily Count was easy (index="03122018" | stats count as "User Submits" by USER_NBR, USER_NAME) however I cannot figure how to create a query that will count the events and average them over the month. I want to stay away from a subsearch as I think that will add to much overhead to the search and I'm confident that the eval command is my answer but after bashing my head unsuccessfully against SPL for the last day I'm not grasping the answer. Anything anyone can do to help would be greatly appreciated, thanks for reading. ... View more