I have the below query
index=abc sourcetype=xy.. |timechart span=1d count as events by host | addtotals
time h1 h2 h3 h4 h5 h6 h7 total
2017-11-24 2334 68125 86384 120811 0 28020 0 305674
2017-11-25 5580 130912 172614 199817 0 38812 0 547735
2017-11-26 9788 308490 372618 4742120 0 112607 0 1277715
How do I calculate the average of h1 for the last 7 days and similarly for all other hosts
↧