topic Activity Counts in Splunk Search

Activity Counts

OliverG91 — Fri, 23 Oct 2020 09:10:30 GMT

I am looking for a way to list the counts by customer (for example, including 0 activity) for the past hour, among all customers so far that has had activity since the start of the day.

Example: John (15), Dave (10) and Maria (8) so far for the day. Within the past hour: Dave (3).

The result I am looking for is something like this:

John (0), Dave (3), Maria (0).

I have looked at map, joins and subsearches, but nothing so far works. I need to list the 0 activity as well since they have been active for the day, just not in the last hour. Any ideas?

Re: Activity Counts

ITWhisperer — Fri, 23 Oct 2020 10:16:22 GMT

``` get hourly count by user over period of search ``` | bin span=1h _time | stats count by user _time ``` reset counts to zero for earlier hours ``` | eval count=if(_time >= relative_time(now(),"@h"), count, 0) ``` sum counts by user ``` | stats sum(count) as count by user

Re: Activity Counts

OliverG91 — Fri, 23 Oct 2020 20:52:17 GMT

It worked perfectly, @ITWhisperer . Thank you very much!