Community:Search Report: How To Create a Table of Day of Week - Monthly Average Vs Daily Average

Search Report: How To Create a Table of Day of Week

Monthly Average Vs Daily Average

#
# Monthly Average Vs Daily Average (No Diff)
#

index=_internal source="*metrics*" group="per_index_thruput" earliest=-6w@w latest=-2w@w
  | bucket _time span=1d
  | eval DayOfWeekC=strftime(_time, "%a")
  | eval DayOfWeekN=strftime(_time, "%u")
  | stats avg(kb) AS AvgDayKB by DayOfWeekN, DayOfWeekC

#
# Compare Month Average and the Last Week
#

index=_internal source="*metrics*" group="per_index_thruput" earliest=-4w@w latest=-2w@w
  | bucket _time span=1d
  | eval DayOfWeekC=strftime(_time, "%a")
  | eval DayOfWeekN=strftime(_time, "%u")
  | stats avg(kb) AS AvgDayKB by DayOfWeekN, DayOfWeekC
  | append
     [ search index=_internal source="*metrics*" group="per_index_thruput" earliest=-2w@w latest=-1w@w
            | bucket _time span=1d
            | eval DayOfWeekC=strftime(_time, "%a")
            | eval DayOfWeekN=strftime(_time, "%u")
            | stats avg(kb) AS AvgDayKB_LastWk by DayOfWeekN, DayOfWeekC ]
  | stats first(DayOfWeekC) AS DayOfWeek, first(AvgDayKB) AS KBavg_Month, first(AvgDayKB_LastWk) AS KBavg_LastWeek by DayOfWeekN
  | eval Diff=KBavg_Month-KBavg_LastWeek
  | fields DayOfWeek, KBavg_Month, KBavg_LastWeek, Diff