Community:Search Report: How To Create a Table of Day of Week - Monthly Average Vs Daily Average
From Splunk Wiki
Search Report: How To Create a Table of Day of Week
Monthly Average Vs Daily Average
# # Monthly Average Vs Daily Average (No Diff) # index=_internal source="*metrics*" group="per_index_thruput" earliest=-6w@w latest=-2w@w | bucket _time span=1d | eval DayOfWeekC=strftime(_time, "%a") | eval DayOfWeekN=strftime(_time, "%u") | stats avg(kb) AS AvgDayKB by DayOfWeekN, DayOfWeekC
# # Compare Month Average and the Last Week # index=_internal source="*metrics*" group="per_index_thruput" earliest=-4w@w latest=-2w@w | bucket _time span=1d | eval DayOfWeekC=strftime(_time, "%a") | eval DayOfWeekN=strftime(_time, "%u") | stats avg(kb) AS AvgDayKB by DayOfWeekN, DayOfWeekC | append [ search index=_internal source="*metrics*" group="per_index_thruput" earliest=-2w@w latest=-1w@w | bucket _time span=1d | eval DayOfWeekC=strftime(_time, "%a") | eval DayOfWeekN=strftime(_time, "%u") | stats avg(kb) AS AvgDayKB_LastWk by DayOfWeekN, DayOfWeekC ] | stats first(DayOfWeekC) AS DayOfWeek, first(AvgDayKB) AS KBavg_Month, first(AvgDayKB_LastWk) AS KBavg_LastWeek by DayOfWeekN | eval Diff=KBavg_Month-KBavg_LastWeek | fields DayOfWeek, KBavg_Month, KBavg_LastWeek, Diff