Thank you for your reply. I will dig in further and see. I'm not the primary Splunk admin on our network, but I'll relay this information to him. ... View more

We have Horizon VDI VMs that people login to with zeroclients. I have a scheduled task on the golden image set to run a script on login to create Event ID 9999 that logs the username, zeroclient name, zeroclient IP, VM name, and VM IP.  That allows us to see what zeroclient each user is using to login to what VM.  Since we already had that event, we also wanted to be able to see a running daily average number of VDI logins that occur to determine how many VMs are in use per day in the average workday. So as VDI usage increases, we can make sure we have enough resources. ... View more

I was able to get it to work with this (I THINK): source="wineventlog:application" EventCode=9999 earliest=-14d latest=now | eval date_wday=strftime(_time,"%A") | search NOT (date_wday="saturday" OR date_wday="sunday") | bin span=7d _time | stats avg(count) AS Avg | eval Avg=round(Avg/14,2) That search displays a number that looks to be about the average amount I expected per day. Thank you for all your help! ... View more

When I put the exact code into search field, I get a table with dates (which are M-F dates, which is good) on the left under "_time" and an "Avg" column on the right that is blank. ... View more

I should've mentioned that this is for a <single> dashboard value. So I have it as follows: <single> <title>Daily Average</title> <search> <query> source="wineventlog:application" EventCode=9999 | eval date_wday=strftime(_time,"%A") | search NOT (date_wday="saturday" OR date_wday="sunday") | bin span=1d _time | stats avg(count) AS Avg BY _time | eval Avg=round(Avg,2) </query> </search> </single> ... View more

Thank you for the reply. When I use the following: source="wineventlog:application" EventCode=9999 | eval date_wday=strftime(_time,"%A") | search NOT (date_wday="Saturday" OR date_wday="Sunday") | bin span=1d _time | stats avg(count) AS Avg BY _time | eval Avg=round(Avg,2) It displays a "0" with an arrow to a smaller zero instead of the average number per day. Doing a search adding each part, it does appear to remove Sat and Sun data, though. ... View more

And is there a way to restrict the average for the first query to only Monday through Friday of the current week, but also only include days that have past (for example, if it's Thursday, show the daily average for Monday through Thursday)? ... View more

Thank you for this. How would you do that same thing, but for daily average for this month only? ... View more