I'm trying to do something pretty straightforward, and have looked at practically every "average" answer on Splunk Community, but no dice. I want to compare total and average webpage hits on a line chart. I calculated and confirmed the standard (fillnull value=0) and cumulative (fillnull value=null) averages with the following:
host.... | bin _time span=1h | eval date_hour=strftime(_time, "%H") | stats count as hits by date, date_hour | xyseries date, date_hour, hits | fillnull value=0 |appendpipe [| untable date, date_hour, hits | eventstats avg(hits) as avg_events by date_hour | eval "Average Events"= avg_events | xyseries date date_hour avg_events | head 1 | eval date="Average Events"]
How do I plot hits and avg_events on a line chart by date_hour? Also, if there is less convoluted SPL to get the same results, I'd love to know that as well—because I think I found where Google ends.
... View more