Calculate average number of calls by user

[msarro]

Here is our situation, we handle calls. Every call generates a record. We would like to find out, over the span of 1 month, what the average number of calls every customer makes. Logically you'd figure out the number of calls made by each customer every day for a month, and find the average. Then you'd find the average from each of the 30 days. I haven't been able to wrap my mind around a way to do this with splunk.

Any ideas on how to do this? I'd appreciate the help. Thanks!

[jonuwz]

search that returns customer and call data
| bin _time span=1d
| stats count as calls by _time,customer

Now you have the number of calls per customer per day

The key thing is bin - this massages the times to the closest day

Add the following for average calls / day per customer :

| eventstats avg(calls) as avg_calls by customer 

or if you don't need so much detail :

| stats avg(calls) as avg_calls by customer