index=mainframe
sourcetype=BMC:DEFENDER:RACF:bryslog
host=s0900d OR host=s0700d
| timechart limit=50 count(event) BY host
| addcoltotals
I am looking add the AVG from each 1 week total for each day
You could try something like this
| appendpipe
[| stats avg(*) as average_*]
| addcoltotals
| foreach average_*
[| eval <<MATCHSEG1>>=if(isnull(<<MATCHSEG1>>),<<FIELD>>,<<MATCHSEG1>>)]
| fields - average_*
That is amazing, Thank you. I am new to the Splunk world as you can see. How about a field next to each host that calculating the %of the total average per count?
It isn't clear what you mean here, % of the total average? Do you mean the percentage of the total for that host that the count represents, or the percentage of the grand total for that host? Since you have also used timechart, I guess you could also mean the percentage of the total for the time bin that the count for the host represents.
It is probably best if you work out what it is that you are trying to show in your table/chart to clarify what the required calculation is.
This is what i am looking for: well maybe
Date S0100D S0400D
Friday 2024-04-11 4880961 (75%) 5247555 (35%)
AVG 34509759 4750349554
If that makes sense
Not really, 4880961 (75%) means what? 4880961 isn't 75% of any of your other figures.
these were dummy numbers, apologies. percent change of the average
This is what i am looking for:
Date S0100D S0400D
Friday 2024-04-11 200 (50%) 250 (25%)
Saturday 2024-04-11 600 (50%) 1750 (75%)
AVG 400 1000