Getting Data In

_time Issues with Monthly average

reverse
Contributor

I have data in a CSV with below format..

2 columns Date & count

All I want is monthly average ..

| timechart avg(count) span=1mon wouldn't work.

Please guide.

2019-05-01  0
2019-05-02  0
2019-05-03  0
2019-05-04  0
2019-05-05  0
2019-05-06  0
2019-05-07  0
2019-05-08  136
2019-05-09  62208
2019-05-10  56432
2019-05-11  618
2019-05-12  5604
2019-05-13  130244
2019-05-14  152660
2019-05-15  137472
2019-05-16  147968
2019-05-17  130330
2019-05-18  1315
2019-05-19  1007
2019-05-20  137305
2019-05-21  165069
2019-05-22  145031
2019-05-23  135697
2019-05-24  139552
2019-05-25  390
2019-05-26  203
2019-05-27  196
2019-05-28  154001
2019-05-29  160133
2019-05-30  160315
2019-05-31  145855
2019-06-01  1540
2019-06-02  1471
2019-06-03  184624
2019-06-04  192080
2019-06-05  199334
2019-06-06  176690
2019-06-07  168967
2019-06-08  490
2019-06-09  1684
2019-06-10  206361
2019-06-11  227472
2019-06-12  212830
2019-06-13  214682
2019-06-14  176739
2019-06-15  338
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query.

| inputlookup yourlookup.csv
| eval _time=strptime(Date, "%Y-%m-%d")
| timechart avg(count) span=1mon

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query.

| inputlookup yourlookup.csv
| eval _time=strptime(Date, "%Y-%m-%d")
| timechart avg(count) span=1mon

reverse
Contributor

Perfect! Thank you .. worked like a charm .

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...