Archive
Highlighted

How do I divide the number of calls to a page by number of jsessionds?

Engager

I'm looking at Apache access logs for a Java application and on some occasions we see large numbers of calls to a particular page, basket.do, per session. We've worked out a good start search:
sourcetype=access_* uri="/basket.do" |stats count by JSESSIONID |SORT by count desc to show us the JSESSIONIDs that make the most calls. I want to get an average of /basket.do calls per JSESSIONID per hour.

Tags (1)
0 Karma
Highlighted

Re: How do I divide the number of calls to a page by number of jsessionds?

Splunk Employee
Splunk Employee

Have you tried something like this:

sourcetype=access_* uri="/basket.do" | stats count by JSESSIONID AS jsess_avg | chart avg(jsess_avg)

I'm kind of shooting in the dark as I don't have a data set to test it.

0 Karma
Highlighted

Re: How do I divide the number of calls to a page by number of jsessionds?

Engager

That's bringing back what looks like an hourly sum of JSESSIONIDs which have basket.do calls. I need the sum of /basket.do calls, divided by the number of unique JSESSIONIDs.

0 Karma
Highlighted

Re: How do I divide the number of calls to a page by number of jsessionds?

Ultra Champion

Does this work for you :

sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by JSESSIONID,_time | stats avg(count) as "Avg Per Hour" by JSESSIONID | sort by "Avg Per Hour" desc
0 Karma
Highlighted

Re: How do I divide the number of calls to a page by number of jsessionds?

Splunk Employee
Splunk Employee

sourcetype=access* uri="/basket.do" | bucket span=1h _time | stats count by uri,time, JSESSIONID | stats count avg(count) by _time

Not sure i have good data for this but let me know if this is what you need. I think the avg is what you want. Take a look at it without the final stats command...let me know if this is on the right track.

View solution in original post

Highlighted

Re: How do I divide the number of calls to a page by number of jsessionds?

Engager

That does it! Thank you.

0 Karma