Avg count of last weeks to current week by day.

[sandeepmakkena]

| multisearch
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
| eval event="1", when="then"
| eval event=event/2]
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
| eval event="1", when="now" ]
| eval Hour = strftime(_time,"%H")
| chart sum(event) AS events over date_wday by when
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7)
| sort 0 sort_field
| fields - sort_field

This seems to working fine, but I want the avg count to be always a integer. I tried round and other functions they didn't work.

[jnudell_2]

Hi @sandeepmakkena ,

Round should work for providing an integer value as a result, but remember it's rounding, meaning if you have 3.51 it would round it to 4, and not set it to 3.
After your | chart ... line you would put:

| eval events = round(events, 0)

If you want to drop the fraction instead of rounding you would use:

| eval events = mvindex(split(events, ".", 0)

[niketn · Accepted solution]

@sandeepmakkena do you want the following?

| eval then=round(then,0)

Also, event eval does not seem necessary based on your query. Can you try the following?

| multisearch 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
    | eval when="then"] 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
    | eval when="now" ]
| chart count by date_wday when
| eval then=round(then/2,0)
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7) 
| sort 0 sort_field 
| fields - sort_field

[sandeepmakkena]

This seems to be working, Thanks for your time.

[niketn]

@sandeepmakkena I have converted my comment to answer. If your issue is resolved please accept to mark this question as answered.

[niketn]

@sandeepmakkena if your issue is resolved, dont forget to mark the question as answered as this would help others facing similar issue as well.

[somesoni2]

Any specific reason to have | eval event=event/2 in your first query?