Splunk Search

Compare the NOW-1d count of event with the averageof the last month

fedevietti
New Member

Dear All,

I've got a problem with a Splunk search. I'd like to compare the last 24 h number of sent mail with the daily average of the last month.

The search that I'm using is the following:

sourcetype="sophos" pmx_action="keep" fur!="none"| bucket span=24h _time | timechart span=24h count | stats last(count) as today_count avg(count) as avg_count

The problem is that this search compare the average with the count of the event from 00.00 of the last day to the NOW time.

My will is to compare the NOW-1d count with the average. Is it possible? Regards

Tags (1)
0 Karma

lguinn2
Legend
sourcetype="sophos" pmx_action="keep" fur!="none"
earliest=-30d@d latest=@d | stats count as dailyCount by date_mday | stats avg(dailyCount) as  monthlyAvg |
join [search 
sourcetype="sophos" pmx_action="keep" fur!="none"
earliest=-24h@h latest=@h | stats count as todayCount ]

This search gives 2 results: monthlyAvg and todayCount

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...