I am using the following query to calculate the average events per second
| tstats count where index=* groupby index, _time span=1s | stats avg(count) as AverageCountPerSec
However, the number is lower than one of the indexes. What did I miss? How to calculate the average events per second for each day from the past week?
Thanks.
You want to calculate EPS for each index or for all? Also, you say each day of past week, so you expect 7 rows with showing average of each day of last week?
try this,
Average,
| tstats count where index=* by index _time span=1s | stats avg(count) as avg by _time
Overall,
| tstats count where index=* by _time span=1s
For index wise,
| tstats count where index=* groupby index, _time span=1s | xyseries _time, index, count