Can you clarify what doesn't work or share more details about your search? My token example works fine for me.
index= _internal earliest=-30d
| fields _time
| bucket _time span=1d
| stats count as total by _time
| streamstats avg(total)
| sort -_time
| eval day=strftime(_time,"%b %d, %y")
| table day total avg(total)
day| total | avg(total)
Mar 05, 18|3349|85247.33333333333
Mar 03, 18|4107|101627
Feb 18, 18|66397|126007
Feb 17, 18|227887|145877
Feb 16, 18|171441|104872
Feb 15, 18|38303|38303
... View more