Splunk Search

Comparing avg of last couple of week days transactions with current week day

sandeepmakkena
Contributor
sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TIDearliest=-2w@w1 latest=@h+h 
| eval StartTime=relative_time(now(),"@w1") 
| eval Series=if(_time>=StartTime,"Today Count","Average Count") 
| eval Hour = strftime(_time,"%H") 
| stats dc(TransactionId) as count by date_wday Series 
| chart avg(count) by date_wday Series
| eval sort_field = case(date_wday=="monday", 1,
    date_wday=="tuesday", 2,
    date_wday=="wednesday", 3,
    date_wday=="thursday", 4,
    date_wday=="friday", 5,
    date_wday=="saturday", 6,
    date_wday=="sunday", 7) 
| sort 0 sort_field 
| fields - sort_field

Lets say we have 4 transactions on June 03 2019 and 6 on June 10 2019 the avg count should be 5 but here I'm getting 10 as my avg count, can someone help me.
Thanks in advance.

0 Karma

woodcock
Esteemed Legend

There is no reason to ever do something like this:

| stats ... BY foo bar
| chart ... BY foo bar

Whatever you are trying to do here, is either wrong (perhaps you only need 1 BY filed on the chart, not both) or can be done in a single call.

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...