topic typical week base on month data in Splunk Search

typical week base on month data

JakubJ — Wed, 02 Sep 2020 06:25:49 GMT

Hello,

I'm trying to chart typical week of our web application users based on data from last 4 weeks. Idea is, roughly explained, that I would calculate sum of request group (login, user accounts, etc - already done) per day and then created some type of "7 day window" in which there would be (seen in a graph) only 7 days but each day would be average of that day from last month.

So in a graph there would be (for example in case of request_group='login'):

Monday - 10 - which si average of sum in all mondays (10, 10, 5, 15, 10)
Tuesday - 8 - which is avg of sum in all tuesdays (8, 10, 6, 8, 😎
...and so on up until Sunday

part of my search is:

host "server" sourcetype="access_combined"
... some eval stuff ...
| fields _time request_group
... here should by magic calculating data ...

Thank you in advance. I've already tried different approach using streamstats or timewrap, but nothing worked as I intended.

Re: typical week base on month data

thambisetty — Wed, 02 Sep 2020 06:42:17 GMT

index=_internal sourcetype=splunkd_access | bin _time span=1d | stats count by date_wday,_time | stats avg(count) as average by date_wday

Re: typical week base on month data

thambisetty — Wed, 02 Sep 2020 07:14:29 GMT

please like my answer if it solves your problem.:)

Re: typical week base on month data

JakubJ — Wed, 02 Sep 2020 07:38:01 GMT

thank you for your hint. I was able to include this into my search, so last part in my case looks like this:

host "server" sourcetype="access_combined" ... some eval stuff ... | fields date_wday _time request_group | search request_group!="other" | bin _time span=1d | stats count by date_wday,request_group,_time | chart avg(count) as prumer by date_wday,request_group | eval sort_field = case(date_wday=="monday", 1, date_wday=="tuesday", 2, date_wday=="wednesday", 3, date_wday=="thursday", 4, date_wday=="friday", 5, date_wday=="saturday", 6, date_wday=="sunday", 7) | sort 0 sort_field

sorting is based (coppied 🙂 ) from https://community.splunk.com/t5/Splunk-Search/Days-in-Alphabetical-Order-but-need-to-be-in-day-order-Tried/td-p/150403