Here is our situation, we handle calls. Every call generates a record. We would like to find out, over the span of 1 month, what the average number of calls every customer makes. Logically you'd figure out the number of calls made by each customer every day for a month, and find the average. Then you'd find the average from each of the 30 days. I haven't been able to wrap my mind around a way to do this with splunk.
Any ideas on how to do this? I'd appreciate the help. Thanks!
search that returns customer and call data
| bin _time span=1d
| stats count as calls by _time,customer
Now you have the number of calls per customer per day
The key thing is bin - this massages the times to the closest day
Add the following for average calls / day per customer :
| eventstats avg(calls) as avg_calls by customer
or if you don't need so much detail :
| stats avg(calls) as avg_calls by customer