Need to run the below query for a month
If i run the below query i will get results for the yesterday AVG count.
sourcetype="X"| bin _time span=1s | stats count by logtime | stats avg(count) | eval date=strftime(now()-86400, "%d-%m-%Y") | table date avg(count) | eval 'avg(count)'=round('avg(count)',0) | fields - avg(count)
Output:
date 'avg(count)'
12-05-2020 11
But i want to get the AVG count for a month or 6 months.
Please suggest me to update this query to get the results as expected for 6 months , each day AVG count i would need.
Thanks
Pradeep
... View more