https://community.splunk.com/t5/Splunk-Search/How-to-search-the-average-and-median-of-the-number-of-events-per/m-p/214691#M62953 <P>Hello!</P> <P>I need help with a search.<BR /> Let's imagine we have Windows logs. These logs contain the field <STRONG>Username</STRONG>.<BR /> I want to calculate average and median for number events per second per each unique username. <BR /> Strategic goal is to form something like a baseline - "average user generates so much events per hour/day/week". And detect anomalies based on this.</P> <P>How can I do it?</P> Tue, 26 Apr 2016 08:11:45 GMT ibondarets 2016-04-26T08:11:45Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-average-and-median-of-the-number-of-events-per/m-p/214691#M62953 <P>Hello!</P> <P>I need help with a search.<BR /> Let's imagine we have Windows logs. These logs contain the field <STRONG>Username</STRONG>.<BR /> I want to calculate average and median for number events per second per each unique username. <BR /> Strategic goal is to form something like a baseline - "average user generates so much events per hour/day/week". And detect anomalies based on this.</P> <P>How can I do it?</P> Tue, 26 Apr 2016 08:11:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-average-and-median-of-the-number-of-events-per/m-p/214691#M62953 ibondarets 2016-04-26T08:11:45Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-average-and-median-of-the-number-of-events-per/m-p/214692#M62954 <P>Try something like this. Below should give you events per second for each user.</P> <PRE><CODE>your base search to get windows logs with field _time and Username | bucket span=1s _time | stats count as eps by _time Username </CODE></PRE> <P>Now to calculate avg and median eps per hour/day/week, try like this</P> <PRE><CODE>above search | bucket span=1h _time | stats avg(eps) as avg_eps median(eps) as median_eps by _time user </CODE></PRE> <P>Change the span to 1h for hour, 1d for day and 1w for week.</P> Tue, 26 Apr 2016 14:34:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-average-and-median-of-the-number-of-events-per/m-p/214692#M62954 somesoni2 2016-04-26T14:34:38Z