topic Re: count events per user, showing average latency in Splunk Search

count events per user, showing average latency

tmarlette — Wed, 30 Oct 2013 21:14:02 GMT

I am attempting to count the number of times a user has made a web server 'hit', and also display the average latency of that/those users.

Search Query:

sourcetype=www NOT hck=* user=< user > | stats avg(time_taken) as "latency(1s)" | stats count(user) by latency(1s)

I can't seem to get the fields to come out right, either I get just the latency, or the count and the latency without the user.

Re: count events per user, showing average latency

kristian_kolb — Wed, 30 Oct 2013 21:35:28 GMT

should work,

sourcetype=www NOT hck=* user=< user > | eventstats avg(time_taken) as latency | stats count(user) by latency | rename latency as "latency (1s)"

UPDATE:

perhaps this is what you're after:

sourcetype=www NOT hck=* user=* | stats count as hits, avg(time_taken) as "latency(1s)" by user

Re: count events per user, showing average latency

kristian_kolb — Wed, 30 Oct 2013 21:39:21 GMT

Or wait. That does not seem right. What do you really want? Provide sample events and sketch of desired output, please

Re: count events per user, showing average latency

tmarlette — Fri, 01 Nov 2013 13:40:39 GMT

Actually I just tweeked this a little bit, but you were pretty much spot on. Here is the final search:
sourcetype=www NOT hck=* | eval user=user."@".domain | stats count as hits, avg(time_taken) as "avg latency(1s)" by user | sort - "avg latency(1s)"