Thanks to both linu1988 and martin_mueller, my question was answered. The correct query for what I am trying to accomplish is: sourcetype=iis | timechart span=1d dc(c_ip) as daily_uniques | eval weekday = strftime(_time, "%w") | stats avg(daily_uniques) by weekday ... View more