topic Average Hits per Minute by Distinct SourceIP in Splunk Search

Average Hits per Minute by Distinct SourceIP

mattreidy — Tue, 01 Mar 2011 03:04:05 GMT

I'm interested to know the average hits per minute by distinct source IP address from my web log data for a given time period.

(I'm sure this is REALLY simple but I've yet to figure it out...)

Thanks!

Re: Average Hits per Minute by Distinct SourceIP

dwaddle — Tue, 01 Mar 2011 03:46:43 GMT

This sounds like a good use of timechart, something like

my_search | timechart useother=false span=1m count(_raw) by src_ip

Re: Average Hits per Minute by Distinct SourceIP

mattreidy — Tue, 01 Mar 2011 04:23:37 GMT

This gives me the raw count, but what I'm really after is the average of the count per IP...

Re: Average Hits per Minute by Distinct SourceIP

dwaddle — Tue, 01 Mar 2011 07:23:18 GMT

So lemme see here matt -- are you looking to reduce this to a single value per time period that is the avg# of per-ip hits? If so, the above search should be easily adjustable to do that. Please advise.

Re: Average Hits per Minute by Distinct SourceIP

gkanapathy — Tue, 01 Mar 2011 08:40:31 GMT

The above is giving you the count of hits per distinct src_ip. But I suppose what you want is the count of distinct src_ip values, which is ... | timechart span=1m distinct_count(src_ip)

Re: Average Hits per Minute by Distinct SourceIP

gkanapathy — Tue, 01 Mar 2011 08:40:58 GMT

Sounds to me like you really want the count of distinct source IPs, not the count by each source IP.

... | timechart span=1m distinct_count(src_ip)

Re: Average Hits per Minute by Distinct SourceIP

tgow — Fri, 04 Mar 2011 03:55:40 GMT

Is the search you are looking for:

... | bucket _time span=1m | stats dc(clientip) as dcip count(clientip) as totalcount by _time | eval avg_hit=(totalcount/dcip) | fields + _time, avg_hit