Reporting

How do I divide the number of calls to a page by number of jsessionds?

selvig
Engager

I'm looking at Apache access logs for a Java application and on some occasions we see large numbers of calls to a particular page, basket.do, per session. We've worked out a good start search:
sourcetype=access_* uri="/basket.do" |stats count by JSESSIONID |SORT by count desc to show us the JSESSIONIDs that make the most calls. I want to get an average of /basket.do calls per JSESSIONID per hour.

Tags (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by uri,_time, JSESSIONID | stats count avg(count) by _time

Not sure i have good data for this but let me know if this is what you need. I think the avg is what you want. Take a look at it without the final stats command...let me know if this is on the right track.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by uri,_time, JSESSIONID | stats count avg(count) by _time

Not sure i have good data for this but let me know if this is what you need. I think the avg is what you want. Take a look at it without the final stats command...let me know if this is on the right track.

selvig
Engager

That does it! Thank you.

0 Karma

Damien_Dallimor
Ultra Champion

Does this work for you :

sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by JSESSIONID,_time | stats avg(count) as "Avg Per Hour" by JSESSIONID | sort by "Avg Per Hour" desc
0 Karma

mwhite_splunk
Splunk Employee
Splunk Employee

Have you tried something like this:

sourcetype=access_* uri="/basket.do" | stats count by JSESSIONID AS jsess_avg | chart avg(jsess_avg)

I'm kind of shooting in the dark as I don't have a data set to test it.

0 Karma

selvig
Engager

That's bringing back what looks like an hourly sum of JSESSIONIDs which have basket.do calls. I need the sum of /basket.do calls, divided by the number of unique JSESSIONIDs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...